# Title: Phishing URL Snort2 Ruleset
# Updated: Thu, 22 Sep 2022 00:02:38 +0000
# Expires: 1 day (update frequency)
# Homepage: https://gitlab.com/curben/phishing-filter
# License: https://gitlab.com/curben/phishing-filter#license
# Source: https://www.phishtank.com/ & https://openphish.com/

# Notice: https://curben.gitlab.io/phishing-filter-mirror is moved to https://curben.gitlab.io/malware-filter
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"000000000000000000zimbra.circulosolidario.sv"; content:"Host"; http_header; classtype:attempted-recon; sid:200000001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"000076782817655.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"000667993.codepen.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200000003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"000update.mytinyhomevillage.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"000update1.alsgroup-eg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0049731647300048374001.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"00877676infodaviplarta90.daviplata010.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"009877898767809999.start.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200000008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0150tree.xequcevusy.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200000009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"02e-br0u.ru.xsph.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0310f955.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"038-smallbusinessesrelyoncustomers.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200000012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"03829gh.byethost3.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0796223.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"09-0vnhjew-0rtnbg-09nhws-9r0ng-9wn5rgrg.obs.ap-southeast-3.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"09-fdereewdwewweeeeeeeee.ezyro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"094890-32839156.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0bs.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200000018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0bu7kw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0ffice336272-0000-3338.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0g09rebqe8ms76om9oaq8oemd1t066ke0j725els0lpmpclkoh54heg.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0lx-informing.902184.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0lxshop-goods.6554546.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0olut8.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0pensea.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0utlook-shared-storage-01.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0utlook-shared-storage-01.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0utlook-shared-storage-03.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0utlook.0ffice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0web.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1-sso-nifty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1000008546785235984201.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200000032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1000008546785235984202.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200000033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1000008546785235984203.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200000034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1000008546785235984204.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200000035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1000036598795624.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1000036598795625.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1000036598795626.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1000036598795628.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1000x.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200000040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1023r5740f5200111ee89.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1023r5742nsserv1csecur1ty.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"104.129.12.61"; content:"Host"; http_header; classtype:attempted-recon; sid:200000043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"104.129.205.92.host.secureserver.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"104.168.173.244"; content:"Host"; http_header; classtype:attempted-recon; sid:200000045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"104.168.173.248"; content:"Host"; http_header; classtype:attempted-recon; sid:200000046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"10423584007000176.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"104326535054541.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.152.110.21"; content:"Host"; http_header; classtype:attempted-recon; sid:200000049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"10e20o30u37.260mb.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"10messages.pending.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1111365.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1111365585547384.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1112689753185922332.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"11307dfb122022pak3s10.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"116.202.28.120"; content:"Host"; http_header; classtype:attempted-recon; sid:200000056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"120901805221826-am.web.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200000057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"122128965729233.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"125498365683135466.epizy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"12678.27631.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"128739819.continue012.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"129.226.211.22"; content:"Host"; http_header; classtype:attempted-recon; sid:200000062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"12daviplco1223.kaskkoe.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"134.122.22.221"; content:"Host"; http_header; classtype:attempted-recon; sid:200000064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"142.11.214.173"; content:"Host"; http_header; classtype:attempted-recon; sid:200000065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"143li.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1446765768230008.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"147.182.137.233"; content:"Host"; http_header; classtype:attempted-recon; sid:200000068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"147.182.221.11"; content:"Host"; http_header; classtype:attempted-recon; sid:200000069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"149.56.117.104"; content:"Host"; http_header; classtype:attempted-recon; sid:200000070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"14gqb.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"14jlr.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"151.106.113.176"; content:"Host"; http_header; classtype:attempted-recon; sid:200000073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"153in.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"154.222.238.46"; content:"Host"; http_header; classtype:attempted-recon; sid:200000075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"156la.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"158q9.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"15e92.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"15eos.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"15fa6.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"15mzz.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"15twu.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"15u7z.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"15uba.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"15udv.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"161.35.142.2"; content:"Host"; http_header; classtype:attempted-recon; sid:200000086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1611659748350570.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"162.144.125.199"; content:"Host"; http_header; classtype:attempted-recon; sid:200000088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"162.222.215.185"; content:"Host"; http_header; classtype:attempted-recon; sid:200000089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"163-1ew.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"165.227.194.222"; content:"Host"; http_header; classtype:attempted-recon; sid:200000091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1659761148350570.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"167.71.45.12"; content:"Host"; http_header; classtype:attempted-recon; sid:200000093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"174page3eprotectionsservic3s3curity.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.128.62.233.dsl.dyn.forthnet.gr"; content:"Host"; http_header; classtype:attempted-recon; sid:200000095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"179.43.141.107"; content:"Host"; http_header; classtype:attempted-recon; sid:200000096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"179.48.65.130"; content:"Host"; http_header; classtype:attempted-recon; sid:200000097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"18.222.193.136"; content:"Host"; http_header; classtype:attempted-recon; sid:200000098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"180110116028.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1822direkt-info.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200000100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1822direkt-team.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200000101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"190854.8b.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"198.148.100.124"; content:"Host"; http_header; classtype:attempted-recon; sid:200000103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"199102481445514444.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1and1ionos.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200000105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1contaconline1.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1e2e3f.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1frsjkbvadsayt.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1ihch.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200000109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1ihch.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1inch-bonus.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1inch-io-stage-app-euc1.s3-website.eu-central-1.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1inch.exchenge.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1inch.mypixieset.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1lnch.host"; content:"Host"; http_header; classtype:attempted-recon; sid:200000115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1monxt.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.136.95.251"; content:"Host"; http_header; classtype:attempted-recon; sid:200000117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"20.214.184.4"; content:"Host"; http_header; classtype:attempted-recon; sid:200000118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"20.219.216.216"; content:"Host"; http_header; classtype:attempted-recon; sid:200000119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"20.226.106.173"; content:"Host"; http_header; classtype:attempted-recon; sid:200000120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2002moevmqq4103du17j5gncq6355n6dfjgmqdkm9cgmohsi0utjrso.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"20101305090886952021.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"20228787help54664support78.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2022riskhelpsecure.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"20297-4043.s2.webspace.re"; content:"Host"; http_header; classtype:attempted-recon; sid:200000125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"20503022222044.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"206.189.201.145"; content:"Host"; http_header; classtype:attempted-recon; sid:200000127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"206.81.15.214"; content:"Host"; http_header; classtype:attempted-recon; sid:200000128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"207037696000000.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2072596754663237747300.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"208.82.115.230"; content:"Host"; http_header; classtype:attempted-recon; sid:200000131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2080-0513905-70520.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"208164f1-0d7a-430f-a661-8c8d123284f8.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2100369.conffir21.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"21501-4030.s1.webspace.re"; content:"Host"; http_header; classtype:attempted-recon; sid:200000135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"21508-4036.s1.webspace.re"; content:"Host"; http_header; classtype:attempted-recon; sid:200000136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"217651.8b.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"22-09.obs.na-mexico-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"22686745e.349812f.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"23487623423.456422.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"237558763284658.9755436.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"23b.rhjac.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"247bitspals.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2486379587467.536436545.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"24electrician.245.mrsmartprinting.com.my."; content:"Host"; http_header; classtype:attempted-recon; sid:200000145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"25a9ff8c.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"27618-zaplata.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"284965f5-7be3-40e1-b93e-92366ea5fce3.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2919b233c1ea8fde21529cd0bb040be4-dot-office-352115.uk.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2938675358256483.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2ac08924.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2amzrom.co.jp.zdaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2dr.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2fa.bthei.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2n.k5wn.cheeseconnoisseur.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200000155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2wwwbecommunityh.gaiiciab.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2wyslijpaczkeip389184.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3.92.0.79"; content:"Host"; http_header; classtype:attempted-recon; sid:200000158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3.94.109.135"; content:"Host"; http_header; classtype:attempted-recon; sid:200000159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3243gr9r3h2.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3245thbt43vwbr3b54bn2b2eq3wrrwt4nreb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"32515641313215456.epizy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"327864283747.566576879.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3298re09432.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"32wwatudya166118721850-eikrqdy9tkhsmc0pep6lutkai-ved0ah.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"334cro0w0n-0findsxsrf44aliczsbuwdygpuztoceb2flboua0.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"342535125624124756.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"342535125624124756.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"343i.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"346497.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"34839783344hg5566.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"35.174.73.17"; content:"Host"; http_header; classtype:attempted-recon; sid:200000172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"35.192.38.184"; content:"Host"; http_header; classtype:attempted-recon; sid:200000173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"351432894574850002.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"365be.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"370.pef.2575.conscientiouscapitalinsights.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"376736.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3a10a178.s6t6sj4s46tu4sys54y5.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3bro-ufabulousquotient.elegua12.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3dlenticular.com.sg"; content:"Host"; http_header; classtype:attempted-recon; sid:200000180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3ff7c459-86b2-4f6d-b6b0-ba6402ef6cb0.htmlcomponentservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3j124.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3kq1.tq7p.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3sercfvhbjvfrd4erfvhjndfvnbm.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"400cgpe9ftgophh71dks1uopj54felhbrbg9iv21eagktj8435lmdp8.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"405capital.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"416522000123897.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"419gbmuab-d4195.conagopareimbabura.gob.ec"; content:"Host"; http_header; classtype:attempted-recon; sid:200000188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"42e2391f.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"434sxsrf-aliczsbqv44hdenmfxsiflmx0iztgjtppo.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"43gbr-vfck3we-5rtjgk-wrkjgv-kwe-tbjgh-werjkv-f09-fd.obs.af-south-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"43gf948h3s.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"43qf5-qqaaa-aaaad-qdaca-cai.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"45-79-139-46.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.55.167.181"; content:"Host"; http_header; classtype:attempted-recon; sid:200000195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4581jnr8b-d4585.conagopareimbabura.gob.ec"; content:"Host"; http_header; classtype:attempted-recon; sid:200000196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"45fbec5e-7c7d-444a-ab3f-61caf5d4f2db.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"465732.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"47.89.49.243"; content:"Host"; http_header; classtype:attempted-recon; sid:200000199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4710463d43910.bonactech.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"47826.nuveveriyonetimi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"47b117c9-cdf6-4030-b5d1-90a96edcd3a1.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"48519283-86de-4ef6-9db2-7be27af47c73.htmlcomponentservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.51.43.12"; content:"Host"; http_header; classtype:attempted-recon; sid:200000204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4bx28w.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4rfuel-com.preview-domain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4season.com.kh"; content:"Host"; http_header; classtype:attempted-recon; sid:200000207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4tgh0-984608hg-0e3hrt5ng-0ewhnrg-0hnberg-0.obs.ap-southeast-3.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4w8bmmjcw86e.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"51.fi"; content:"Host"; http_header; classtype:attempted-recon; sid:200000210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"52.20.22.249"; content:"Host"; http_header; classtype:attempted-recon; sid:200000211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"53vzxcnk6rwp.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"54289993039409563.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"545487875454212ip.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"546782d6.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"549wt515b-d5495.conagopareimbabura.gob.ec"; content:"Host"; http_header; classtype:attempted-recon; sid:200000216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5578805078050785078i.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5646854132103213561453.epizy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"564rgg453-ba1901.ingress-comporellon.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200000219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5667566098886665477.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5688785462648234706.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200000221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5688785462648234708.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200000222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5948948.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5apps.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200000224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5b0f6cb9-0485-4fc7-9775-eb74bb45bbf6.htmlcomponentservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5cabe435-cc0e-487a-9031-1fa2d891cd16.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5gb0-onedrive.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200000227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5spoons.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5tu.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5wiah3.klaastemedia.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200000230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"600cm8vfjkgnd70vnk87bema48l1oaelqi2ficnii0qu0ejshpjss1g.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6128565463651654.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"61da8ae6.6u6566hrrthsh45.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"626525.selcdn.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"631b926d23091.site123.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200000235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"63463777-665-1219.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200000236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"638ca12d-ba2f-451c-8418-faf56b7de7ff.htmlcomponentservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6476927823772099930.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"66.212.22.201"; content:"Host"; http_header; classtype:attempted-recon; sid:200000239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"67.205.181.48"; content:"Host"; http_header; classtype:attempted-recon; sid:200000240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"67889562325a.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"68.183.201.58"; content:"Host"; http_header; classtype:attempted-recon; sid:200000242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.49.247.144"; content:"Host"; http_header; classtype:attempted-recon; sid:200000243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"69830weqwq.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6ar9ss.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6betterweedirectoryseg.223355.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6w5nu-ayaaa-aaaad-qdtha-cai.raw.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"70cf446d-79c1-4ac5-8568-24b8e51cf1a3.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"72352723-54360.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"72352723-54362.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"72352723-54363.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"72352723-54366.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"72352723-54367.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"73251045-06f5-4e2f-958a-65269b616616.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"73725722.domohost.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"745b4e1ad89467221.temporary.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200000256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"750shein.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7567585662116566.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"766320.selcdn.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7685634658976564.25436844.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"778944462464b.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.108.89.240"; content:"Host"; http_header; classtype:attempted-recon; sid:200000262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"780030.selcdn.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"790329.selcdn.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7b631qxp.r.us-west-2.awstrack.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200000265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7c576797.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7cf3fd69.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7dbe4fff.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7fusw1fl.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7webabds2e6dgmp4g34count.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7x5dvh.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7yu3v.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"80-108-82-166.cable.dynamic.surfer.at"; content:"Host"; http_header; classtype:attempted-recon; sid:200000273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"80880568352345467899.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.161.229.161"; content:"Host"; http_header; classtype:attempted-recon; sid:200000275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"82v8b.app.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200000276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"83.212.106.222"; content:"Host"; http_header; classtype:attempted-recon; sid:200000277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8577348.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"873734349834.start.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200000279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"873twc.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8757436545690.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"87ff99760ac5d463.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"89888756.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200000283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"89939.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8auahx.assertiviadoc.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200000285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8d7af84c.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8dd401c2dbf4c414704450bd2b72fc89-dot-office-352115.uk.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8f3260ae-0189-426b-9619-bcb612f00b5a.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8ihrdsvrhu9ouirwasdh0piuhrsfeh7uji.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8pancakeswap-finance.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200000290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8vs.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"92.204.144.8"; content:"Host"; http_header; classtype:attempted-recon; sid:200000292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"943151c8c3ad.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"98485login.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"98578login.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"986821122128965729233.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"9966a.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"9980.informacionn.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"9d62cfee-59b3-42a8-9542-4b3a32692792.htmlcomponentservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"9ftytucsh4ph.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"9janewshub.com.ng"; content:"Host"; http_header; classtype:attempted-recon; sid:200000301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a.60b7ac265566e3da4341f765b2d2a73200f8f1db57b0b005a1afdc00.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a.dab342ab8887461995aad393cb294948a5ce800ca279cd1027026d47.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a.eddyx.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a.gibsonwine.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a.insecurpage.recovery-safty.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a0570626.xsph.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a0w0kt.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a1.parkingsuvio.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200000309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a2e2d331-80b4-499e-b24e-14af8aa3a18b.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a4be6a33-a2a9-4b0f-ae04-71f23b9a45c6.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a4d3b42c.chgmar-d8y.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a71843c1.mailssocloud-srvr65e5rd.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a76uh-rqaaa-aaaad-qcycq-cai.raw.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aa.astepforwardnv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aa.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200000316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aa52ea7e73864.bonactech.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aaa33f221bff69e7c4f0cb9ad1b3d53d-dot-office-352115.uk.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aaa33f221bff69e7c4fecb9ad1b3d53d-dot-office-352115.uk.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aaaa-9qg.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aaattttssssbbbbbccccc0000.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200000321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aabbccee-86c0a.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aabbccee-86c0a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aabqhaygas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aacpvyrzzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aafbcbqbrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aagmfatauy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aaiuidnack.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aajkabahujanmedia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aakrgdwtxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aamsgbikgu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aandjstudios.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aap.org.pk"; content:"Host"; http_header; classtype:attempted-recon; sid:200000333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aapdillxqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aapeiqnzhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aaphdffehg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aapivvqwiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aapks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aaqdoykbhw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aaqrpvzgfp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aarr.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aasdygsolf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aastyqnmgr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aavedefimax.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aavelend.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aavemq.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200000346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aavuppqpsk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ab.galeish.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abatedsbqo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abbfxwdwml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abbwflxdya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abfrage-sicherheitscheck-spk.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200000352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abgitrzcal.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abikytravels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abmqigbmlv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abncra.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abozabakwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abpijwutyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abqlfivtyi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abracadabra-walet.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abrahooo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"absolutepleasure.com.my"; content:"Host"; http_header; classtype:attempted-recon; sid:200000362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abttiqktwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abuekohtxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abuelacassandra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abumuadz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abvfrkkthc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abyavaaulr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abylleknhg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ac-rukaten-bank.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"academia-rennersolucoes-portl.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"academy.thenobleguardians.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acagudpqrj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accedi-area-clienti.buraq.org.pk"; content:"Host"; http_header; classtype:attempted-recon; sid:200000374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accedi-area-pagamenti-id.itsaol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accediareacliente.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accedirestrizioni.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceso-galicsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesovirtualdaviienda.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesrewards.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"access-verify3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"access-verify3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"access-verify6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"access-verify6.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"access-verify9.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"access-verify9.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesscdn1.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesscdn10.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesscdn2.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesscdn6.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesscdn7.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesscdn8.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesscdns.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesscdns10.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesscdns2.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesscdns3.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesscdns4.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesscdns5.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesscdns6.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesscdns7.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesscdns9.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesso.clienti.sicuro.eshteghalepaydar.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200000402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accessoanomalia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accessobancabper.aljone.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accessobancabper.wartatimes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accessobperbanca.relianceplacements.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accessobperbancaweb.cloud.cpanelbudgethosting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accessreward.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account-access-review.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account-access-review.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account-check.co.jp.bs0wel.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account-check.co.jp.eektrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account-check.co.jp.heqywy.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200000413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account-check.co.jp.jhktpl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account-check.co.jp.ugzeks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account-check.co.jp.xgpthy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account-info-review.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account-resolution-support-center-amz.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account-security-review-100586.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200000419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account-security-review.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200000420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account-update.mymom.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200000421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account.royalirisinc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account.verifications.help-page.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accounts-aktualisierung-dkb.cleansite.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200000424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accountsg-secured.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200000425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accuraatbv.nl"; content:"Host"; http_header; classtype:attempted-recon; sid:200000426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acdvdvdvsdatt.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acdypyphwg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acess-ofici-fatura.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acessar-digital-fatura-br40.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acessar-fatura-hoje-0sw6e.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acessar-fatura-web-digital-sadsd5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acessar-minha-fatura-setembro-0yx6w9.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acessfaturaitau.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acesso.meupersonalite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acessodedodemo.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acessoibank8.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acessovlahiper.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acgznaleoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"achat.pay-sas.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"achulemarecoa.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"achulemarecoa.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aciermetal.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acjddacyzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aclgoizbxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aclgqwcpdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acmjnfawcd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acmrmeekzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acn.unpbls.sprt-acn.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote001.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote001.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote002.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote002.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote003.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote003.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote004.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote004.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote005.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote005.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote006.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote006.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote007.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote007.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote008.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote008.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote009.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote009.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote010.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote010.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote011.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote011.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote012.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote012.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnscure.cnfrm.scrthlp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnvuccrfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acordion-stela.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acsdhvgxz.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"act-premco.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200000478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"activate-hulu-com-activate.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200000479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"activatesynmainnet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"activatiioncode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"active787-beb.base787bed781.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acuascut.bluehoststaff.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acwmiyafzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acxpeelxsf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acymaffwkj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adanakedifilesi.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adanothrnf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adbrevocdd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adcapitals.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adcloudserver.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adcsumrhml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"addoha.ci"; content:"Host"; http_header; classtype:attempted-recon; sid:200000493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adept-producer-5628.ck.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200000494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adfpbqgbmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adjdhgfxpx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"admin-formserviceupdates.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"admin.epochfinancialus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adnflhmdbx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adobe1-2536c.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adobe1-2536c.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adobe2-d56fa.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adobe2-d56fa.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adobepdfllc.mypixieset.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adoring-wilson.134-122-35-165.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200000505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adpunemploymentclaims.sharefile.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adrenalinasertaneja.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adroitorganicssmartexpress.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adroitorganicssmartexpress.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ads-manager-case83400917.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adsnlzwjfw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adsvtmodcw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adugpdjaob.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adv-promote.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"advancedrecruitments.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200000515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"advancelink.easy.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"advanceneworleans.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adveninternational.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"advsrbewrb.kmedikel123.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adwoplok-investing.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200000520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adyoojyugz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aean.org.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aec02ussba39485auth-yahoouserid4734.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aefmwkfqcx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aefyouiagz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aejwrqbgcb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aemazon.co.gdf84fgd3g4.sprgrouup.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aemazon.co.jplogindfs3dg5hcx.bjktg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aemazon.co.jplogindfs3dg5hcx9.nbspy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeojseufnv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon-bakk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon-card.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon-dudu124.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon-japan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon-vip.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon.1vgdu4.afojigtsuy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon.7nflwu.afojigtsuy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon.7q0p1t.afojigtsuy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon.84a0ui.afojigtsuy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon.9k0b28.afojigtsuy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon.c97jhq.afojigtsuy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon.f1zmk6.afojigtsuy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon.k8mblr.afojigtsuy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon.yfqvus.afojigtsuy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon.zmirqo.afojigtsuy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeonaccount.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeonbadk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeonbamk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeonbamk.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200000549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeonbask.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeonoyyy.vnapf8.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeonoyyy.z9xzzr.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeropartscr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aerospacesses.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aerspyhyla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aervatxwaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aervicecatert.interbankconet.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.ufwybn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeseoescn.asseosoeseesaccn.gnpais.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeseseoiosecsn.asseeososceeueossceacn.gzfmft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesexdvomp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.ilechun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.qrgj.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.zjnkse.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoesn.aseoseseacn.mojnlk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoesn.aseoseseacn.qxkahc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoioesn.aseoseiseaccn.tnklun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoiosesn.aseosieesceacn.rkbxko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aessnuxhff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesszyhvgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesymjrazh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aetaxapvgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aezacwdozw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afcu-sms.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afcu-sms.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afcunionhub.myvnc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afddglsdcnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afdndzthck.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afeadfgc.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afestvpljt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"affixwallet.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"affxtdfvmi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afgrznpakt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afitdmqtaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afiygrkpmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afobjgtmol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afopomtfcz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afp--futuro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afpphitgfr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afqzmqptbr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afrleotnpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afrosalmon.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afsdaaaa-d1cb7.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afsdaaaa-d1cb7.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afterpay.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200000595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aftral.comlaurence.chretien-laurence.chretien.weareaunitednation.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afvadbscgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afvsamtyiq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afyllyqhku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afytloezlz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afzjjfoume.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agbbmhgprn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agence-88069.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agence-88069.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencenote003.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencenote003.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencenote009.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencenote009.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencesgwn001.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencesgwn001.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencesgwn004.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencesgwn004.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencesgwn005.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencesgwn005.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencesgwn009.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencesgwn009.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencesgwn011.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencesgwn011.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.bhifly75390.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.bhiflyk40710.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.bhiflyk69875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.dcgobmyh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.deutschemkgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.kpdgmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agodarentacar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agoyggnjrw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agreatstaffingcompany.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agrhsypjxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agri-cole-fr-t-i.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agrimetiersmartinique.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200000630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agroblockchain.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200000631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agvddquqrj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agvmosrxjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agxnounoxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahadconsultancy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahaybdwrir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahdkmotgne.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahelplmpwy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahhckfxpgu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahhhh.pe.kr"; content:"Host"; http_header; classtype:attempted-recon; sid:200000640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahjdoovcsx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahmkdcdzip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahoradebesconfirmardatos.091267.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahoramismo.vista-it-support.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahpxvkdvxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahrgafbrub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahztryqxrj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aibmlulsor.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aichi-bp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aicse.edu.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200000650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aihfbj53bl.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200000651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aikcunbwms.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aikrxdfmex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aindytwory.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aioovtnytw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aisjhablgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aisohfxbil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aisqbxwjes.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aisvqefsfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aixlsfvaka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aiyiwkkash.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aiyobhbaad.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aizik-whatsapp-firebase-clone.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aizzudznqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajdutboalj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajikzpxtkr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajiostores.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajirmgcxsh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajjetuduyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajmjnlitkx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajobfyboaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajpxuxjwkt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajuenwsmxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajvbcomlcd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajwucjzfny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akanksha3012.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akanmubamidele.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akaropczmh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akavwdzmsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akemidentalspecialists.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akhs.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200000681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akjqzrruct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akljfmymnb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akmd01.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akpfxvdhfb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akqlyuxdaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aks34.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aksamqhrhx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aksdmmazjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aktinautla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aktualizacja.jst.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200000691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akzojuomyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"al1l1i.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alareentading-catalog.page.tl"; content:"Host"; http_header; classtype:attempted-recon; sid:200000694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alaskaclassifiedonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"albaitalkhaleejibh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"albaraka-bank.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"albel.intnet.mu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"albertoliviera014.outgrow.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200000699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"albertomingueza.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200000700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aldana.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200000701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aldypszesl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alegrolokalnie-delivery.3200052.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alerta-accesoclientes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alerta-inter.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alerta-novobanco-movil.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alertabangrupo.alertabancolo.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alertas-bancofalabella.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alerts.department.improvement.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alertsmtsecure01.otzo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alexcoteltee.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alfjlqyvnj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"algazeliya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"algeebgezx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"algotextil.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alialinedssc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alidaled.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alimentosybebidasrefrespul.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alinaaslanyanphotography.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alinafischer.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aliniwohi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alinstantecon.imprenditorecomunicatore.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alior.gokwaz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alitekniktools.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alkhalilgraphics.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alkhoornkt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alkorplan.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200000727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allbrowardanimalremoval.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allcountylandsurveyor.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allegr0lokalnie-delivery.8099096.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allegro1okalnie-shop.894321.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allegrolokalnie-market.7599051.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allegrolokalnie-purchase.423960.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alleqrolokalnie-shop.698745512.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alleqrolokalnie-storepay.794812454.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alleqrolokalnie.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200000736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alliedschoolsahiwal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alliiant.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allocation-familiale-secure.idsc.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200000739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allpacafiinancse.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allpacaflinance.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allyoucanget.dyndns.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200000742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"almamaz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"almosthumandolls.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alnxheeuap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alpha.radyum.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alppmuuigy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alquiladoralosangeles.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alrbmptlke.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alrxhenykp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alsarrajjewellery.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alsofft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"altecmetalltechnik-energiasolar.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"altsavings.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"altunhaliyikama.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200000755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alwnwurqdb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alydsdwekb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amaozn.ywcimei.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon-interruption.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon-jp-org.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.83090z.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.ca.jp.accountdomainmanagephp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.jp.dsajaskwopoi.pics"; content:"Host"; http_header; classtype:attempted-recon; sid:200000763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.lakurz.cedjfpe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.mig1ha.dflfjytufb.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200000765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.works.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200000766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazonna.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazonng.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazonsp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ambari.ge"; content:"Host"; http_header; classtype:attempted-recon; sid:200000770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ambilchipsedekah.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ambitiouspowerfulspecialist.plaxcolombina.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ambrrygen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ambrygen.care"; content:"Host"; http_header; classtype:attempted-recon; sid:200000774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amburero.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amc-training.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amczon.co.jp.dgeryrhh.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amczon.co.jp.khgfdsdfg.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amczon.co.jp.lbtyb.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amczon.co.jp.sadryr.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amdjalepo.itenlo.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ame-services-inc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ameli-assure-gouv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ameli.redirection-support.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200000784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ameliclient.services"; content:"Host"; http_header; classtype:attempted-recon; sid:200000785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amelie-carte-vitale.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200000786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amelrqzeuw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"america1creditunion.viewdns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"americafirst.d1w.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"americafirstcu1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"americanexpress.ceartavimbomukiccom.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amevilmiaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amh.takeoutlive.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amhwiusoeb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amidabuli.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amiiqpensr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amirhameed.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amizon.co.jp.obertso.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amm-uni.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ammtiadrrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ammyadybad.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amnoloni.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amnzano.co.ip.rdhtrood.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amosleh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amozon.co.jp.dfgjkfg.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amozon.co.jp.dxjsmu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amozon.co.jp.hghgby.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amozon.co.jp.regxgi.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amozon.co.jp.yxjsbx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ampunbanaa.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amreeth.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ams-shared-11.hostwindsdns.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amtrakaccount.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amtvioftmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amusing-jaybird.10web.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200000815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amuskincare.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amwgpzinfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amxjzemcft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amzaom.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200000819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amzom.mzunb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amzpqjliln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ana-techno.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anandsr-dev.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anapolisemprego.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anarchitecturestudio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anasathalassas.gr"; content:"Host"; http_header; classtype:attempted-recon; sid:200000826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anayfjkjaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anazom.co.jp.yigl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anazom.co.jp.yjsow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anazom.co.jp.ylsy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anazom.co.jp.zdsz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ancient-glade-76e4.tralside5454.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ancient-morning-2521.wabrestroom.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ancient-quee6173.tmp6n9c0.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ancient-voice-a281.attnetmms78.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ancient.tybocas.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"andalusstudio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"andersonstrategic.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200000838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"andriaz1700001.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200000839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"andriaz1700004.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200000840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"andriaz1700006.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200000841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anesthesiaqbank.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"angelydigital.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"angindatanglahh.martulangsore.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"angxisifvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"angxwsnsqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anhfrnohqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anhgndslyh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anhnahobxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aniazon.co.jp.djruffg.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"animated-smakager-f30ef0.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"animatedforsakensites.verificdavi0422.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anithbetique.mom"; content:"Host"; http_header; classtype:attempted-recon; sid:200000853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anjalijha167.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ankiety-konsumenckie.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200000855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ankitbadigar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ankqufyjnx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anksqunoic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ann62482.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anomaliarestrizione.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anqudlwsbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anrkoatxbj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anrremovals.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200000863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"antiquepopcornmuseum.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"antlertrader.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"antlia.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anwebnote001.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anwebnote001.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anxoonxhzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aofnasyexj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aofywjkcww.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aogjdavoip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aolmailboxxxxxx-109570.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200000873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aolxperience.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aonqqhlyfc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoovolemua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aorzdfaahn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosadowpvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoskvylunk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aouymfyfra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoykghfnpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ap-bombcrypto-ol.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apalthetioz.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apanxcwgwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aparato8qw7aa.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apartmentliving.co.ke"; content:"Host"; http_header; classtype:attempted-recon; sid:200000886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ape-club.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apedkhngqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apelive.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apeplanetclub.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apet-romania.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200000891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apftnfufln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apgixxlfsp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"api.51.fi"; content:"Host"; http_header; classtype:attempted-recon; sid:200000894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"api.cyou.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apiwhesgooe4560.page.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200000896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apkenvios.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200000897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apkfcthzrj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apokasz.my.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200000899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apoyosbienestar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app--bombcrypto-io--acess.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-aave.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200000902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-axie.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-cfa1e8e2-8e5a-42f9-a5cf-27238a3922a5.cleverapps.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-id6016.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-id6016.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-id8109.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-id8109.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-paidy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-poly-g0nwebsite.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-quickswap.exchange"; content:"Host"; http_header; classtype:attempted-recon; sid:200000911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-sushi.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-sushiswap.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.aavve.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.assessmentgenerator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.flowtechlinks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.formbuilder.ai"; content:"Host"; http_header; classtype:attempted-recon; sid:200000917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.hubgdpr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.magicceden-welcome-0sd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.magiceden-hello-nfts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.magicedenn-home-we2d.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.magicedenn-login-s25d.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.minhafaturadigital-w9sz6.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.minhafaturawebdigital-s7i8.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.moneylinecreditcorporation.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.multidefiprotocols.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.pncservice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.singlelink.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.speedywaiver.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.sugarsync.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.waiverforever.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app42.host"; content:"Host"; http_header; classtype:attempted-recon; sid:200000932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appbtcommunication-hub.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appbusiness-bt-3722d6.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appbusiness-bt-8f55e4.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appcef2022.10001mb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appeal-check.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appeal-check.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appealanotherservic3s3curity.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apphelpmeng-eprroflicexsubmtt-inffrmhlps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appissueresolve.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apple-contactless-review.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apple-pay-later-gb.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apple-pay-later-gb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apple-pay-suspend.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apple-pay-suspend.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"application.axisbank.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200000947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appmngerhllppnewsinfr-accnttaxmngerprflife-infrms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appmybtconnectbill.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appora.sviluppo.host"; content:"Host"; http_header; classtype:attempted-recon; sid:200000950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appreter.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"approdo36.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200000952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"approve07b-auth3469.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apps.qattanfoundation.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appsuite.currentplug.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200000955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appsushi.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appvencha.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appworksconsulting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aprjoafuol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aprobaciononlineinmediatadesdetucasa.mxom.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200000960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aprobadoahoraaqui.usedcomputer.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200000961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aprus.co.jp.jokekaal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apsei.org.pt"; content:"Host"; http_header; classtype:attempted-recon; sid:200000963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apsenzsa.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apsewas.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aptmrzjovo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apukycbpcl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apxxhvjhdx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apykkiliay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apzrpamhbs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqbllmuwmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqcgfryvrj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqgsctjeov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqigypsfvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqltqawwry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqmuxz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqojjrewrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqrnqqqvtx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqsckmacqw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqserfdzdj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqsucdlfdf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqtvbsvxli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aquarelle.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200000983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqvifincny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqvytccojg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqxgolqiqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ar-rvest.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ar-rvest.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arabianoasis.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arafathrumman.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aramex-confirmation.com.ae.shubhkarman.ae"; content:"Host"; http_header; classtype:attempted-recon; sid:200000991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aratfhfixk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ardorcare.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"areabperweb.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200000994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"areaclientibper.theamazonhelper.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"areainpsprivati.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"areapersonalewebmps.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200000997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"areasoluzioneweb.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200000998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arfnisweuo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"argalicia-clave.supploc.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"argaliciaonlinehome.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"argeonppfz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"argoconstruction-auth-0ffice365-folder.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"argoconstruction-auth-0ffice365-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arhmvshjrh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ariiskele.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ariseac.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200001007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arjjlbsomv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arlindovsky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arlus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"armaghanenajaf.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arnaldolanches.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arojzgeeqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aroundupapp.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aroundupapp.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arproofing.walywyfiw.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arqhsafbhi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arrdcoxyhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arre-9do.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arrozsabanero.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"artemka500shiola.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arthamahotels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"artngvfufy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"artsiluette.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arub-service.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arvikithxe.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200001026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arxdozfkkd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aryjaavnyh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arzmwazrty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"as9192030.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asa-q98.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccfagykf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ascen.formazionefad.fingeco.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200001033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ascxpzckkj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asdclqvpoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asdjqlleis.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asdrewd.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200001037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asegurodviajessa.aventurasyviaj.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asesoriabarrachina.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200001039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asesorinformatico.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ashedeoisdsipor.vamsoqeusi.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ashleighgreinersh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ashleymadison10.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ashleymorrowsh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ashlylealsh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ashpazieana.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asicpod.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asjpylvflf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ask-cg.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200001049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"askarmotorluaraclar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"askfedfred.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asmlgsyfhy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asnlvkqyyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asnskufqjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asotqbqhjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asrdjtmwyg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asrivlig.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200001057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assamaha.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assbtfcatw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assessoriabradesco.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asset-file-project.files-secret.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assets-project-cloud.reconfirmation-zip.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assistenzaanomalia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assistenzadipartimento.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assistenzak6bperrweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assures-ameli.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"astxmhfrpx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asuhjaskfasfasf.scsjidjkfd.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asuntox92929.verificacio19.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asxzcse.4tv9m0.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asyqsnycge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"at-t-yahoo.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200001072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"at0.srev.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atbkemwtsk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atd-company.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atd-company.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atencionalonlne.asistencya.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"athleticbustlingformats.jyfutdiyt.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"athuuwfweh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atigbjmsjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atkmqeaatz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atlantacolocation.services"; content:"Host"; http_header; classtype:attempted-recon; sid:200001082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atlantida090.626252.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atm-i.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atmosdesign.com.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atnr76dxku336szy.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atnuptlrtq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atotlom46.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atplxvtjyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atshop.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200001090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-100066.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-100852.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-101212.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-101547.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-102840.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-1030.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-103060.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-103289.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-103403.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-103826.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-104759.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-104931.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-105350.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-105431-102210.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-105549.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-105709.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-105799.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-106115.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-106122.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-106174.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-106443.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-106647.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-1068281.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-107099.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-107257.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-107538.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-108684.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-109404.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-109791.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-11.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-allusers.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-currently-105027-104057.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-email-updating.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-expired-4de4.att-expiredms1.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-logindemositesupdating.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-mail-10.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-mail-102828.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-mailbox-2022.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-secureandprotected.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-security-review.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-team-101512.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-team-103828.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-upgraded.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att.akknds.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200001134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att.rukutoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att1.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200001136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attaccountlogin247.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attaccountveri.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attacker.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attadmincenter101.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attbellsmondss102922.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attclock.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attemailongoinupdates247frmit.boxmode.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200001143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attemplate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attentivewellmadeaudit.replealtan.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atthcrtcax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attiva-app-bper-ip.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attivadati2022.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attjsszomp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attloginpage-10208855.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attloginpage-103691.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attloginpage-10638680.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attloginpage-1084624.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attmail-10347909.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attmail-10353600.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attmail-1071750.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attmail2e.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attmailbox677.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attmailbox8r55.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attmailinfo.boxmode.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200001160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attmailonlineserviceaccount.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attmailserviceupdate-103969.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attme-109741.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attnesecurityservernew.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attnet-101433.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attnet-101897.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attnetserviceoperator.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attserviceupdate.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200001168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attsystemserverrr.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atttime.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attupdaterequestupc.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attzcxffclfjlggflggghjjhjljhjjhhk.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atualize-sistema-segurancaaa-ilyasshkk200758.codeanyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atvimeyayi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atwwamckhd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atyjcaxpos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atykucpsyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-0002.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-account.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-login-service.signinau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-login-service.signinaua.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-login-service.update1fd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au20th.adobersserl.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aucnujvctt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"audience-upholstery.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aufhuungzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aui493849934324zim.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aui493849934324zim.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aukfxnvmbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aukqosuzrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aulavirtualmibanco.freshdesk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aumenta.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200001192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aumentdisp.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200001193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aumento-web.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aumento-web.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aumentocupo20221.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200001196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aumentocupotuya.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200001197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aumentodecupoh.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200001198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aunment.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200001199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auogxyreir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auomupwejd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aupay.dj3koa.sadfqirewr.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200001202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aupkwghhvp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aupxdhgnmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auraschoolpmna.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auretechnologies.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aurntexsrt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ausftx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ausps.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200001209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"austerebagxnn1001s.succennn.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"austinl33.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200001211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aut-jil-f7dd.dmarce.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autentica-20304.dreamhosters.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-09.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-arvest.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-arvest.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-cliente-privato.itsaol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-document-shared.datingg-voice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-login-user.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-login-user.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-task1-m.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth.secure-bigpond.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth0sharefid0000000200000ff1ce009id31d2bb9c.auth0rizesharedo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth1b-jb.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth1b-jb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authb-hase.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authb-hase.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authb-jb.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authb-jb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authb-jpmorgan.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authb-jpmorgan.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authbhase.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticate-0oxsoxauthe.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticate-user-online.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticate-user-online.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authentificationpaiement-servicesecurise.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200001236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authhunton.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authhunton.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authjb.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authjb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authnav00.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authorise-id-apple.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authorise-id-apple.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authorizeref-insetup.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authservice2fmail.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authuxeehmutconjxmailssocl.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authyprobank.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200001247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autobotslekomiok478.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autodiscover.ryder-dutton.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200001249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autohauspodcast.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200001250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autoinsurance.penny-stocks-gps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autolexliner.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autorectifytoken.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autoscurt24.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200001254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autosnissan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autumn-sun-4a21.paqesads-scure.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auutegdgdg65.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auutegdgdg65.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auxiliosocial.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auxovfuyge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auxxxxxxxxx.smb.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200001261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auzimoahbv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avantilovekc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avcggjrtcg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avdmornifi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avemlmnvub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avfnroyerk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avhostings.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.1p2ap08.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.40sbkn9.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.67ets1t.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.7sq5xol.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.acojek2.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.ad6zu4j.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.anqcgo.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.arbzal.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.asclab.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.axvpsr.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.axwmwk.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.ayczzs.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.ayynuu.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.bcowma1.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.bfzfkk.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.bnequq.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.brj3o6d.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.bv6u6sw.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.bytirnb.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.ceszno.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.cfmmcc.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.cou17gj.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.daoxal.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.dcggok.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.dlvwhc.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.dzxvjl.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.epduyp.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.erstm5s.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.ewjvlp.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.fbcsrf.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.gnvikzo.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.gpnzgi.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.jkbtvl.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.jrxtrx.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.kebujh.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.kfeyef.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.khfzku.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.lbjcqh.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.lhrlkr.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.nqhywi.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.ntk466j.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.oeauteo.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.oxo5uzj.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.pnl01rh.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.ppsbcf.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.qnswad.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.rlemhb.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.rljqbs.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.rn0xdmv.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.rvzdfax.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.sfhjtf.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.sxgakd.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.tbbahr5.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.tllpkf.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.togabs.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.udbgrm.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.uieihm.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.uleyron.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.urw49nf.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.vgrsaup.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.vhandn.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.vhvaed.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.vyvkdq.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.whtllp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.x3ywxsy.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.xkukewn.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.y6o61cj.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.ycfbzf.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.yzepa9c.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.zox9nus.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.0aluzd9.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.1gdr53n.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.2aaiklj.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.3r2oxoq.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.67ets1t.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.6ah1rxz.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.acojek2.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.ad6zu4j.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.aprjql.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.asclab.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.axwmwk.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.ayynuu.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.bbogvx.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.bhzykr.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.bjlhhf.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.blblbk.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.bv6u6sw.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.bytirnb.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.cdteph.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.cfmmcc.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.cxzuod.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.dcggok.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.devvza.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.dpovcb.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.dzxvjl.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.ecoi15j.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.eeeejz.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.emutiy.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.epduyp.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.fozmyn.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.fqcxro.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.gbrjfas.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.gisyli.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.gmaphld.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.goinjd.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.gpelhdu.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.gxkcxhn.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.hehbty1.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.hnzbsyi.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.hqmwm27.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.ht6zjbe.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.hxr0gop.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.j5ubutg.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.jsboug.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.kgwqgz.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.kpv6yhp.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.ktcwwov.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.kubvkj.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.nfghnn.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.of5uthp.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.owaiyut.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.pqxamup.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.qyrlqd.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.segeva.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.t0ec6bw.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.tbbahr5.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.tdyoar.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.tlqzfl.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.uleyron.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.urw49nf.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.vgtkezc.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.vsqafmp.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.wpbssyd.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.x1o0ou2.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.xjwvxks.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.xyftnix.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.xyrmwug.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.y6o61cj.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.ydj2q19.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.yklocra.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.zlorenj.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.zox9nus.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.zyojde.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.1gdr53n.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.1p2ap08.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.8b9onfo.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.acojek2.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.aprjql.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.arbzal.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.asclab.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.befcgi.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.bjbh03z.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.bjlhhf.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.blblbk.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.bmlrsvr.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.bomvpw.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.brj3o6d.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.bytirnb.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.cbrcwg.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.cldtta.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.cvtbit.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.dlvwhc.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.dwbuiz.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.dwhodwb.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.dzxvjl.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.ebejok.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.ek6va0y.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.ektixe.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.evsrns.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.ewjvlp.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.ewmqdi.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.fbcsrf.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.fqcxro.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.fvxazeg.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.gbrjfas.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.gijebej.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.gikdch.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.gmaphld.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.goinjd.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.gxkcxhn.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.i9ipcur.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.iojyii.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.kubvkj.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.l7cvwgf.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.lquyvj.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.mjgkwb.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.molxoa.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.mvspqa.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.ntk466j.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.owaiyut.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.p2pfwd4.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.plmioax.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.ppsbcf.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.qr9csce.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.rbqkzx.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.relwog.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.rn0xdmv.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.sgakhql.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.t0ec6bw.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.tbbahr5.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.tdv3bmb.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.togabs.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.umceew.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.vbiuzus.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.vgrsaup.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.vhandn.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.vhvaed.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.wddyfx.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.wpbssyd.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.x1y65xf.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.xkukewn.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.xw5wonm.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.xyftnix.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.ybmykhr.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.yijxdrm.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.yuzksv.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.1p2ap08.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.6hqstri.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.9m4ymbi.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.a59wwgh.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.aakapv.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.agltfj.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.arbzal.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.brpccx.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.bv6u6sw.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.bytirnb.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.cdteph.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.cktnal.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.dwbuiz.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.ezwvtt.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.gbrjfas.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.gkvkwmv.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.gmaphld.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.gxkcxhn.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.hehbty1.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.hkvdul.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.hnzbsyi.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.hqmwm27.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.hxr0gop.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.ikwggv.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.kaldkzh.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.kcbnudb.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.kgwqgz.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.kpv6yhp.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.kqamky.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.ktcwwov.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.lbjcqh.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.molxoa.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.nqhywi.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.nsywex.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.ntk466j.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.oxo5uzj.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.pknnlio.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.pnl01rh.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.rn0xdmv.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.rqgjzca.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.schzxh.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.towybn.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.tp9ufdn.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.urw49nf.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.vflcpnz.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.vgtkezc.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.vhvaed.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.x1y65xf.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.xtquna8.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.xxqgjdj.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.yggusos.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.yijxdrm.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.ynlo5if.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.zjwtdw.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.zzzlky.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avikhnvuij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aviotksadq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avisaboneee.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avitalagro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avkjaqzkwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avkqkeuprl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avlvcemetw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avnjjahfyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avnusdokoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avookkwqkl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avoutrygle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avozmqlpse.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avrapnnlvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.1dhskdt.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.2aaiklj.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.9m1dx7m.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.a59wwgh.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.ad6zu4j.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.aoadwx.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.axvpsr.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.ayynuu.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.befcgi.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.bhzykr.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.bjbh03z.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.bjlhhf.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.bqtksis.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.cldtta.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.cvtbit.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.dzmeui.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.dzxvjl.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.eeeejz.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.ek6va0y.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.gbrjfas.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.gisyli.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.hdyn4ul.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.hmppcy.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.i9ipcur.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.iojyii.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.jrxtrx.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.jsboug.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.ktltos.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.mjgkwb.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.nqhywi.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.ntk466j.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.nwey3w6.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.ohhclj.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.onjfanv.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.orlkpu.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.ouvqak.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.oxo5uzj.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.plmioax.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.q3x8vmb.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.qtjufvf.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.rfuwmd.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.rvzdfax.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.rybtstu.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.sxgakd.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.t0ec6bw.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.tllpkf.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.uieihm.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.uleyron.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.vbdcvc.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.vflcpnz.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.vhvaed.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.wkcbmds.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.x3ywxsy.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.xjwvxks.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.zamgwo.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.zbvjke.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.0aluzd9.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.0fsirhh.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.3e9h13w.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.8b9onfo.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.9m1dx7m.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.acojek2.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.bbogvx.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.bcowma1.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.bfzfkk.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.bhzykr.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.bjlhhf.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.bmlrsvr.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.cmkqku.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.cxzuod.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.daoxal.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.dlvwhc.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.dzmeui.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.dzxvjl.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.ecoi15j.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.epduyp.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.eudyfc0.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.ewmqdi.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.gkvkwmv.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.gmaphld.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.gpelhdu.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.gxkcxhn.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.ht6zjbe.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.i59bh36.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.iqvrzg.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.jkbtvl.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.jrxtrx.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.kaldkzh.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.kcbnudb.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.kgwqgz.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.ktcwwov.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.ktltos.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.kw0cnwm.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.lhrlkr.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.lrwvtyt.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.nlxlcrg.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.nwey3w6.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.owaiyut.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.pknnlio.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.q3x8vmb.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.qrvshpr.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.qyrlqd.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.segeva.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.sfhghim.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.tlqzfl.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.tp9ufdn.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.vflcpnz.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.vgrsaup.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.vgtkezc.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.vhandn.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.vhvaed.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.vl2s0dl.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.wysprt.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.yijxdrm.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.zbvjke.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.zwvk70j.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.0aluzd9.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.1dhskdt.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.1gdr53n.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.1p2ap08.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.3e9h13w.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.67ets1t.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.a59wwgh.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.aakapv.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.agltfj.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.ayczzs.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.bbogvx.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.bcowma1.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.befcgi.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.bmlrsvr.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.ckjvqn.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.cvtbit.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.dpovcb.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.dzxvjl.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.ecoi15j.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.fgwsjfe.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.ggjomnz.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.gijebej.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.gkvkwmv.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.hehbty1.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.hjcbmcu.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.ht6zjbe.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.hxr0gop.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.i9ipcur.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.iojyii.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.jsboug.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.k30p5dz.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.kqamky.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.kw0cnwm.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.lhrlkr.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.lk6s17b.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.mmkzepw.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.nlxlcrg.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.ohhclj.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.orlkpu.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.ouvqak.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.owaiyut.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.ppsbcf.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.qnswad.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.rn0xdmv.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.rqgjzca.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.sciatmc.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.sfhghim.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.sgakhql.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.t0ec6bw.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.tp9ufdn.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.u8b21na.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.uvgoago.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.vgtkezc.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.vhandn.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.vmiutt.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.vsqafmp.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.wddyfx.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.wpbssyd.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.xbmdtb.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.xjwvxks.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.xtquna8.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.xw5wonm.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.xyrmwug.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.yklocra.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.ynlo5if.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.zsdlgq.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.zwvk70j.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.1p2ap08.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.67ets1t.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.6ah1rxz.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.6hqstri.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.anqcgo.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.asivvk.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.bcowma1.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.befcgi.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.bnequq.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.brj3o6d.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.bytirnb.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.cdteph.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.cldtta.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.cvtbit.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.devvza.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.dwbuiz.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.ek6va0y.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.erstm5s.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.eudyfc0.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.ewmqdi.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.ezwvtt.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.f3h0hoz.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.fqcxro.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.fvxazeg.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.gisyli.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.gkvkwmv.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.gpelhdu.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.hdyn4ul.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.hehbty1.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.hnzbsyi.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.ht6zjbe.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.iqvrzg.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.k30p5dz.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.kaldkzh.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.kcbnudb.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.kebujh.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.kfo1w27.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.kgwqgz.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.kpv6yhp.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.lk6s17b.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.nlxlcrg.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.nwey3w6.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.ohhclj.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.ojissf0.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.orlkpu.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.ouvqak.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.p2pfwd4.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.pnm3imk.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.rbqkzx.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.rfuwmd.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.rqgjzca.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.rvzdfax.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.segeva.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.sfhghim.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.tuyfdv.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.tzxgqw.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.ughrxg.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.vhvaed.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.vsqafmp.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.w0zqb68.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.x1y65xf.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.xbmdtb.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.xptjwf.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.ybmykhr.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.ynlo5if.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.yzepa9c.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.0dkul2k.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.0fsirhh.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.2aaiklj.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.3e9h13w.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.54z2thv.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.aakapv.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.acojek2.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.aprjql.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.asivvk.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.ayynuu.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.befcgi.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.bfzfkk.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.bjlhhf.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.bnequq.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.bqtksis.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.bv6u6sw.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.ceszno.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.cfmmcc.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.ckjvqn.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.cmkqku.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.cou17gj.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.ctaf1bo.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.cvtbit.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.dzxvjl.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.ektixe.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.ekyhckm.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.epduyp.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.erstm5s.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.ewmqdi.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.ezwvtt.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.fqcxro.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.fvxazeg.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.gijebej.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.gkvkwmv.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.gmaphld.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.hdyn4ul.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.hehbty1.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.hjcbmcu.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.hkvdul.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.i9ipcur.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.ijamkm.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.kaldkzh.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.kqamky.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.ktcwwov.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.ktltos.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.mmkzepw.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.orlkpu.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.owaiyut.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.p2pfwd4.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.plmioax.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.pnl01rh.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.ppsbcf.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.pqxamup.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.q3x8vmb.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.qnswad.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.qr9csce.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.qrvshpr.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.relwog.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.rybtstu.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.sciatmc.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.sfhjtf.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.sgakhql.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.tdyoar.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.uleyron.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.whtllp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.xjwvxks.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.xyrmwug.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.ybmykhr.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.ydj2q19.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.yijxdrm.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.yklocra.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.yuzksv.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.zox9nus.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.zwvk70j.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.zzzlky.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.0aluzd9.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.0dkul2k.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.0fsirhh.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.1dhskdt.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.1p2ap08.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.2r5v45q.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.6ah1rxz.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.6hqstri.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.7sq5xol.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.9m4ymbi.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.aakapv.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.agltfj.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.aoadwx.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.aprjql.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.ayczzs.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.bbogvx.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.befcgi.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.blblbk.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.bytirnb.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.cfmmcc.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.cmkqku.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.dcggok.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.ewjvlp.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.ezwvtt.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.f3h0hoz.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.fgwsjfe.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.ggjomnz.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.gikdch.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.gisyli.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.hdyn4ul.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.i9jfvsc.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.jjh5qc9.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.k30p5dz.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.kcbnudb.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.kpv6yhp.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.kubvkj.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.kw0cnwm.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.lbjcqh.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.ld8y2wm.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.lk6s17b.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.lpmefip.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.mbizjf.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.no1hppb.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.nqhywi.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.oeauteo.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.of5uthp.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.onjfanv.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.oqeptzu.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.oxo5uzj.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.plmioax.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.qnswad.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.relwog.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.rfuwmd.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.rnwggn.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.rvzdfax.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.sciatmc.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.sfhghim.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.sxgakd.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.tzxgqw.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.uieihm.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.uleyron.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.umceew.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.vsqafmp.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.x1y65xf.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.xjwvxks.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.ydj2q19.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.ynlo5if.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.zamgwo.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.zbvjke.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.zjwtdw.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.zslnpb.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.1p2ap08.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.3r2oxoq.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.6ah1rxz.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.9m4ymbi.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.acojek2.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.agltfj.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.ektixe.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.gnvikzo.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.hmppcy.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.jsboug.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.kfo1w27.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.kqamky.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.ktltos.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.kubvkj.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.kw0cnwm.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.l7cvwgf.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.ld8y2wm.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.ntk466j.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.nwey3w6.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.of5uthp.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.ojissf0.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.pknnlio.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.rn0xdmv.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.sfhjtf.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.towybn.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.vmiutt.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.w0zqb68.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.x1y65xf.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.yijxdrm.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.yuzksv.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.zjwtdw.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.zslnpb.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.zwvk70j.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.9m1dx7m.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.a59wwgh.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.acojek2.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.agltfj.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.axwmwk.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.bomvpw.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.bytirnb.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.cbrcwg.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.ceszno.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.cou17gj.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.cvtbit.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.ektixe.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.emutiy.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.ezwvtt.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.gnvikzo.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.hdyn4ul.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.hmppcy.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200001997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.hqmwm27.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200001998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.kcbnudb.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.kfo1w27.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200002000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.kqamky.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200002001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.kubvkj.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200002002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.no1hppb.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200002003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.nsywex.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200002004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.pnl01rh.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200002005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.ppsbcf.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200002006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.q3x8vmb.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200002007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.qnswad.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200002008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.qrvshpr.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200002009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.qtjufvf.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200002010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.tllpkf.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200002011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.vbdcvc.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200002012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.x1y65xf.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200002013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.xruwfho.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200002014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.xxqgjdj.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200002015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.ybmykhr.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200002016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.ycfbzf.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200002017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.zzzlky.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200002018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avsrcbdrpm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avsybwetzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avtlkqdtgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avtomobil.4me.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avucokrjxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avyofunquh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avzwepumbb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aware.anapeck.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awbzzdcyyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awczhkwqcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awduilttxb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aweeerjpvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awesome-leaders.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awesomelopsidedgraphs.sinpu.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awfohxdwpq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awhcfavoxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awhvxrciyc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awjxsridez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awkqjxcjdi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awnbepoesx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awqioyqkns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awqvuqcibx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awroqdidej.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awvpnnwmwv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awwbbziraw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awwrqyvwcd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awzipfkbpj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axehdzulcc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axeielneflnity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axgotlvljy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axia-land.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axie-infinity.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axie-land-page.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axieinfinily.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axieinfinity-bak.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axieinfinity.simt.ind.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200002054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axieinfiuity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axieinftinite.fun"; content:"Host"; http_header; classtype:attempted-recon; sid:200002056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axienfinity.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axienft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axiinninfinityp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axjalnfinjty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axklcpcjoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axlujnflnjty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axlulnflnlty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axmphlosmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axqlijflgx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axrlakdzja.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axrlakdzja.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axvmvogezn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axvtkerunw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ayalfdigni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aybdqqchpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aydinwruhv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aykjwbnnmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aynibnskji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ayogfofwtu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aypffqnyrx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ayplowwrbd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ayq1-000webhostappu7473ayq1new554one565drive2-newonedrive2.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aysenurbozdogan.av.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200002079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ayudainmediata.portal09.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ayutandrealove.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ayvaxbjbys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ayyrotsfyh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"az-pca.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azgexfjnvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aziende-consulenti-associazionibnl-bnp1234.4nmn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azizi-developments.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azk2e-kaaaa-aaaad-qdwwa-cai.raw.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azkqywknmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azlmzyymyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aznkzamjlb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azswekpith.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azuki-110716005.vercel.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azuki-mint-connect.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azuki.com.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azvsmvumpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azwldputsv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azzmcndfrd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b.45-134-174-4.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b00st.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200002100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b0512850b11759fcd43bec4524ade9.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b0512850b11759fcd43bec4524ade9.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b059c86968a6427389952025bcee9886.svc.dynamics.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b2bxenz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b4e921f0.sso-mailsrvr-4344e5teed.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b97bca39.srvr-cloudmail-srvr6754e5rte.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baanofamericase8.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200002107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"babxismhjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baby-swap.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"babysvvap.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.b2bxmkgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bahif9042.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bhiflyk36637.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bhiflyk48573.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bhiflyk64168.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bhiflyk84276.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.dcgobmyh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bacpayee.contactin.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200002118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bacredomatic.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"badaso-staging.uatech.co.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200002120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeiaseiccnilblsdusmrkofxzzedulqsti52qjejstblyi7oj2ritqq.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeibwcpp2vkw3vf6x3lfktwr6ujy25ptg7wc7sgyyho2bfhzatwxd5e.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeicc2honrihkktsq5kydaha2ixc2q55cz7vzylwwrszyrtcvp256ni.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeicleia5sx5elbtmg5nmrv3lwkupbji2wswwgv6i7wsenle2aphziy.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeiczeb5dsn2ws5znw757twaa4czea4kiiwl2ew6uciwbczfql66kiy.ipfs.dweb.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeida33rhrdrttgvi22vzrxk6kqvhzqhk3w4dv254yyschmqsrgty2a.ipfs.cf-ipfs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeidgoglclt5cimvjbixyjgiisyohl44bnqbugwgfzr6sajxtnxzohq.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeiewt4zaw62kijnftdyurmx2wbchsnn3fbcliferxxee77ptgmns34.ipfs.dweb.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeiewxcgvmer7lbetii3yaujoxe5rtsdzqknc67hhxbzapgbpepkbgi.ipfs.dweb.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeif5da5uioyg7zqeiciidlid2yp5pkrwmolqm3mtw2qlhwfsr4feu4.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeig4warxkemgy6mdzooxeeuglstk6idtz5dinm7yayeazximd3azai.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeigam7m7pztdx6r2pb324rccri52lkyuknlgmyxe4xkwq33asqkysm.ipfs.dweb.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeigmhq6ljlmqdmyqtghz65rw2tptz7lbqhzrfmhwsiyj5zcvulob4a.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeigooaemvo5jticu5xsklnlvtwsbtrrwav5hwuzco4dxpglxndemky.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeigsrdrvuhr7kaajoxaynuihvyhp2bk2ywmvyxqxembg64ohmbmrcq.ipfs.cf-ipfs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeihbb34r4dj5exfimbqepi2c55mreogjzmow53qk4yj54aolgepguu.ipfs.dweb.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeihiwoqryy433j6wlktnlkilossmmecnd67nc3yxjy66xgfofdi2by.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeihsnmtiptw2tirq3rfba4mgdqbrzvrcynn74bgte647u2ithenycy.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bagqgfxrsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baguvixwpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bahar.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200002141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bahazeovhr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bahiacubanpizza.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baigllbyfm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bajurmikkasa.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200002145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bakhai.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baktrvoakb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baleariclifestyle.be"; content:"Host"; http_header; classtype:attempted-recon; sid:200002148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"balisuntour.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ballinasmashrepairs.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200002150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banacionetmes003.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banbifemprsas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banc0naciona1.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banca-electronica1.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banca-porinternetlnterbank.prestamoaprobado-consulta2022.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200002155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banca-porinternetlnterbank2022.credineroalinstante-peru.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancaporlnternetlnterbarnk.aaabestratesmoving.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancaporlnternetlnterbarnk.danielaalmeida.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancaporlnternetlnterbarnk.fannysigns.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancnacion4l.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banco-solidario.entrar.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancodavivienda.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200002162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancodebogota.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancodobrasil.ethicspoint.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200002164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancogalicia.galiciasban.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancogalicia01.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancoitausa.pyus.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancolombia-2.bancolombia000.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancolombia.gruposucursal.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banconacional01.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banconacional040.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200002171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banconacional1.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banconacional796.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banconacional907.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancoorr.metics.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancor-gala.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancor-online.texti.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancosneomc.itaumcneonm.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banditcoil.augeprint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banese-acessoo.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banese-llbank.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banhjarrro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bank-colombia.walthers.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bank.amilbank.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banki0wa.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200002185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bankinghom.bankinghom.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bankinghom.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bannacion4l1.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bannerbank.control-inc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banonline989.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banquepopulaire.wizardly-mccarthy.199-247-13-220.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200002191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baohanhtulanh.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baradua.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200002193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"barbacena.odo.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"barcaenlinea-ibk.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200002195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"barraespaci.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"basketbackup.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"basti-32omna.zealatahimtre.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bathandfloor.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"battlebikefitness.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bavarianhaven1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bavarianhaven1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baxgbpmrzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baxxiffvrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bayclive.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bazyjwpiqc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bb1.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200002207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bb836599.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbadujgjqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbccb.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbdrcqfbto.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbexdfvq.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200002212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbfdcpknrw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbgrhqodxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbgwcfmkaj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbkano.mystoreden.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bblowcostaranto.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bblpijynwd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbmaconline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbmqhecivr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbngztqvmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbnhkoasak.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbomhstpor.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbrwkhdsgt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbsiwbjahp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbsoaohixe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbvlfjveuo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbynkttgwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbzzoilrga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bca.banconr1.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcaobvpefz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcazcqtuup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcdc1cde.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcgjkybebk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bci-sharedfile-oh.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bci-sharedfile-oh.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcidshehle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcjmhutaor.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bckdcoihbs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcnrolikwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcnsgscpkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcp-marketing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcr8j4js4am4v8pt.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcraxxljvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcsaiifczz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcsibutqtd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcuwhvwksq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bczzhtgmqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdaqiagmrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdbgmeuckw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdc-canada.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdcsvr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdescon12empresas.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdf.ijingzhen.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdfbf.78197.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdgfuiqngt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdhobrzorz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdhrhjmgfsvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdnzlfulbx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdryjruaei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdsdhgstjhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdvjuihlck.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdxxkyqtwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdyharviop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdyixwmrkc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdzxxgzlvv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"be-ing-site.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"be-inghome.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"be-itsme-db4bc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"be-itsme-db4bc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"be4yji.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"be4yji.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beautificationld.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beautifulnails.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200002274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beautylablaser.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bebemoss.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200002276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bebxyiomif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bedandbreakfastmarco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beeduzdort.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"befkagjzce.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"begin.submit.q94j.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200002281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"begwejldcc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beho.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200002283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beier.exzmxx6rzk-ypj68kope6l2.p.temp-site.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beingmelinda.organicmelinda.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beipbckccc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bekairos.se"; content:"Host"; http_header; classtype:attempted-recon; sid:200002287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bellsouhs-site.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bellsouth-service0.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bellsouth-verification-service.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bellsouth-verification128.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bellsouth77.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bellsouthemailverificationadmi3.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bellsouthemailverificationadmi70.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bellsouths-site12.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bellsouthverification137.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"belpfwapfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bemzcwpaig.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"benbapwtuo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bendahari.unimap.edu.my"; content:"Host"; http_header; classtype:attempted-recon; sid:200002300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beneficioclientes.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200002301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beneficiotuyapay.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200002302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"benft-extracashsetiembre.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"berjuang.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"berlind.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"berpost.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200002306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"berryblossoms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"berzjhuwfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"besrocfvfl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestadealsmalls.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200002310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestcnanges.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestcryptochange24.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestfriendsbrewingcompany.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestistanbul.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"betamedia.com.ng"; content:"Host"; http_header; classtype:attempted-recon; sid:200002315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"betasegura-viabcp.movil-sms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"betc.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"betcbr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"betrogs.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200002319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"better.com.np"; content:"Host"; http_header; classtype:attempted-recon; sid:200002320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beuulcgika.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bewgmtjuvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bewsthdpoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bexbubemwc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bexwebmailupdate.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beyondcryptofx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfbg.73936.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfbodpdqju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfcsikhmda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfdanpduge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfdb.63279.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfdv.73951.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfeuukszhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfhhherwed.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfhwqkcqgm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfkfcnsrbv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfkplamkba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bflmgkltxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfmm.xlqrmyy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfojzdennd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfpdwlvtdd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfppvpegjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfqrt4ertre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfthiivumm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfuqfkfwyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfyqqhtsuw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfzuvrozro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgcvxsedyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgeqgxxrge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgfqpwznaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgglncogtv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bggsxtcioj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bghpmgsjhk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgielectrical.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200002354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgqzuarnky.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgrfrmuxpu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgtju.llaal.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgtkkzvpoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgxrmulpcu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgxwsvsuiu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgybrthbph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhairavstotra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bharathi1809.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhavin0077.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhftmtujjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhfvouefgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhigqvdtfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhlqtysgja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhnbdxepes.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhrgnbvrtt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhthkqidgf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhutbpwfsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhybolqosm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"biblioteca.sicrediprogresso.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bibtltupdd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bicicentroslezama.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bid-synergyfacilityservices.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bidlyiwjem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bieibmbmom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bienlinea12.sportsontheweb.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bienvenidogracias.validacionen.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bienvenueespace.podia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bigapztdvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bigshortbets.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bijouxacv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"biklosvfzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"billing-status-check.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"billing-status-check.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"billowing-king-3b55.westernbot.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"billowing-king-b316.cabrag7764019.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"binance-1inch.listviewss.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"binanmainzeal.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200002392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"biotogrow.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bipcuwiyln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"birgitkoerner.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bisentechzone.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bishopshawnainital.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bisujxywoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"biswap-staking.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"biswaptrade.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitbaink.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitcoin-gratis.nl"; content:"Host"; http_header; classtype:attempted-recon; sid:200002402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitcoin-store.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitcoinb.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200002404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitcoinsucels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitfinexhkpd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitfloat.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bithunnb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitkub-app.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitkub.digitalhub.co.th"; content:"Host"; http_header; classtype:attempted-recon; sid:200002410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitkub.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200002411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitkub.uk.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200002412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitkubfx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitly.lc"; content:"Host"; http_header; classtype:attempted-recon; sid:200002414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitmart-trust.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitpiecrypto.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitpieex.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitte.modimyk.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitter-moon-9725.regaccounts1009466.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitter-queen-2945.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitter-sunset-daaa.lamseem.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitter-surf-a18b.tyost.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitztmhkns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bizzapp.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200002424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjbqruappi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjcmqhycbj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjdbsdmetc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjhwhnjpjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjiorkaxz.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200002429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjlbcisjth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjlunhyqtd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjmptulaat.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjnalfgifm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjotpokflj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjpmzydgqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjqgvyhvxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjqhrjjmwg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjsfageeuy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjtuynfxja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjutjgguhx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjvbuvmpws.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjwcvwxqet.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjzvpfpejr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkaemauhfgn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkb34lkdl.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200002445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkgaetphsv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkhkxgulng.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkhucmrgip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkilbohymo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bknepwwjty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkooqwulgr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bksameufkg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkuhohjarr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkygxrhpvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkyxvwqbzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkzaszzwcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"black-bonus-a22b.greensandersss.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"black-disk-6500.anyrag8021015.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"black-mode-e8ed-office365.claretteemerald6712.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blackcartaoplaza.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blacksprut.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blank-lebonnncoin.37-221-67-172.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200002462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blcqmkjfli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bleezarun-authbaqtyus.mom"; content:"Host"; http_header; classtype:attempted-recon; sid:200002464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blehbtxblf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bleqkhjpty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blerecovery.22web.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blfjqllpma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blizzardlogin-us.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blkeqnxulx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blnujkleic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bloccooperazionemps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blockchain-wallets.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200002473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blockchainconnect.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200002474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blockchains-recovery.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200002475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blockchains-wallets.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200002476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blockytower5757.051283.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blog-metamask.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blog.brmodels.love"; content:"Host"; http_header; classtype:attempted-recon; sid:200002479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blog.porta-nuova.ch"; content:"Host"; http_header; classtype:attempted-recon; sid:200002480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blokspb.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200002481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blopet.avl-developer.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200002482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bltlvfdcla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bltmkjaftw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blue8z.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blue8z.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blueoceandiamondsjewlery.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bluewaterman.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blvtfhzjwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blxpjaabsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blzcufgxbd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blzghtesrcl.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200002492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmabnlcwrn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmakcibuoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmbbfkzrud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmegroups.bme4718.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmihbxqvoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmjoslfibe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmligvpett.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmlrkonxwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmoobpdhzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmpsmmejpf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmscrapcars.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200002503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmviqrkhyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmw-ecke.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmxwejemgf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmzqafsikb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bn01928712.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200002508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bn1v903ejr405-gbvhn0-ewhngbv0-hnewr50-nhgb5r.obs.ap-southeast-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnacrinform.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnacrsalogin0333.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnb-pancake.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnblever.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncas72376332.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncbncrs2.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncbncrs2123.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncnar.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnconacional.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncontacto00982.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200002519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncprovargacceso.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncr-livers61.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncre.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncrna.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncrsecuryt.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnculan.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bngdiflvzu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnhlvkpbla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnirptevoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnjnynenqo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnkonlinegalicia.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnl-sistema-pubblico-consulentisociale.misecure.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnl-sistema-pubblico-di-identita-digitale.misecure.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnl19-filiale13.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnnacionaluer.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnnacionane.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnpnote004.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnpnote004.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnrcsecunacio.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnrfwixlen.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnrwzouxvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnsmyaqanf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnswor.hwwag.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bntts.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnueoswtyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnz.hardshipuniversity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnzjpssktn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnzxyhuhafxcvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boa.flooss.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boanergesbiblecollege.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"board.pancakesvqp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boatekantokente.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boatqfsuzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bobssigns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boc-update.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boc-update.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bocahviralsmp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boddoevcbn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bodybuilding-muscle-supplements.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bodybycb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boebklpbhu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boetebzojt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bohomasks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boiling.muli.net.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boiziqyojw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bokgabanesolutions.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200002565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bokgjqqbbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bokxwtnxnc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bold-cray.5-255-104-136.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200002568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bold-flower-99ee.pontufbksd.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bold-lake-3a7f.pojeecay.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bold.wvo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boldd.martobang.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bolivar01.bitbucket.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boloafnrnr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bombcripto-game-cv.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bommtfzsra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bomujah.uno"; content:"Host"; http_header; classtype:attempted-recon; sid:200002577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bonolle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"booking-hotel-agoda.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"booksfollower.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boomla.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boostbyq.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boqpiglpvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boredapeyachtclub.special-mint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"borma.co.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200002585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bosbosleon.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bossireland.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"botbxvgdwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"botecodomanolo.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"botnvuwfrf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bountysday.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bouxmlnicy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boxdrop.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boxroyalem11.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boxypty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bozzavojlr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpaszcpitt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpdgttgfgs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpeclick.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bper-it.35-178-159-139.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bper.45-134-174-4.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bperbancaclienti.apmcinternational.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bperbancaclienti.ghapan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bperbancaclienti.sd-weblink.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bperbancaportale.influence-graphique.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bperbancasicurezza.mainly-music.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bperbancaweb.qiagency.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bperbancawebaccesso.besurehomehealth.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bperbancawebaccesso.orientassets.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bphostarea.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpkmggislj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpknxmjcao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpkxojdnwg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bplservicescenter.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpmpdovegb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpnote0010.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpnote0010.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpnote006.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpnote006.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bprauth.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200002620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bprnet.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200002621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpucjofugm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpxrrvhjyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpxx.ivvbh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpymrppsks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqbbzynhdr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqcjuouhka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqdvzfects.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqfrmnauis.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqhqpblune.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqolwufdfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqrjodjuvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqrsjbgbdr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqsarnijax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqynjucpwz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"br352.teste.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200002636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bradescoempresas.bankto.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200002637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brandimayer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brandsforlessegypt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brandsoutlet.qa"; content:"Host"; http_header; classtype:attempted-recon; sid:200002640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brave-gelatinous-puffin.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200002641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brave-hellman.185-101-35-187.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200002642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brcsizdidr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brdh.distktf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"breckenridge.peopletekinc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"breezenvironmental.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brettclinton273.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bridgehublive.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brightwisecleaning.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"briketstroj.hr"; content:"Host"; http_header; classtype:attempted-recon; sid:200002650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"britosracoes.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brjtv.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200002652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brjueyodti.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brjyifrghz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brknlgbvuq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brlvxyvguv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brmaoipwwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"broad-cherry-f932.mlynn1461.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brohgsebroysh.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200002659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brokbv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"broke.bibirpergikedanaubuatan.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"broken-forest-7f7c.westernrollled.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"broken-rice-20d6.richardmayworm252638.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks--canada.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks-forrunning.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks-move.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks-ooke.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks-runfarther.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks-xsbdyugd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks-xsdaodab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks-xsdauofc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks1914.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksair.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksfactoryoutlets.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksforsports.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksghost13sale.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brookshome.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brookslaufschuhe.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200002678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksmajor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksnewmethod.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksnewsports.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksonlinekaufen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksprime.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksrunningcanada.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200002684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksrunninges.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksrunningshoesusa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksrunshoeshopping.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brookssalemalaysia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksshoeau.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksshoesfactoryoutlets.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksshoesmalaysiaoutlet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksshoesoutletonline.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200002692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksshoesstore.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200002693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksshoesuksale.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksshopsft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brookssko-norge.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brookssneakerssale.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200002697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brookssoft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"broucaeporfabor.brouu2.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brouruhomewebonline.brousqueem.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brroooksssale.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bruceslufthadas0291.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bruralcleangtwashing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brwbqnaobw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bryoqaqqqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bs2www2.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsarjwvxub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsbrtkdfri.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bscpad.com.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200002709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsdaflutpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsdfdfasdaf213.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bselomyxzc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsewhukzoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsgbdzthtt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsjkbawtuk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bslcagtzlb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bslivmkgyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bslksigzvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsneiqirqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsnelevkic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsnshlp.sprtacn.scrthlp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsrqhvwocz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bstcynwbro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bstlfidhfy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bstxydqmsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsuhiebabi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsukczyxhc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bswap-finance.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsylenwzyi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-109482.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-business-btcoms.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt.my-style.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200002732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt30i4040e.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt78412576ye753264513476123hsdvsdfvds.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btafmokyqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btbbqocgmr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btbusiness-shobos-dapper-site.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btbusinessappsecure.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btbusinessbilling.wordpress.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btbusinesscommunication.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btbusinessreadybill.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-109798.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200002742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-577268.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-df4517.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btcrus.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btcx2.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200002746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bthqwoidrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btinternet-109793-webn.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btinternet-f17493.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btinternet-web.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btinternet-webmailerhshs.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btinternettqw.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btkatuelwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btlkjhkhhg.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btlyrgh.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200002755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btncxqwudi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btnkkmvnbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btpehxnwsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btsagjonfl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btsei.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btstcbxlhm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bttcazqszm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bttdlovflk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bttsbyrsvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bttvmiecfh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btupbvqcmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btuymbsyjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btwebmailer73676375635934y453456468563458.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btyeqarumu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btzeicznut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btzfevqeks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buaizonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bubcpubwvf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buczndoqgt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"budbngncvg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"budrrpvhlj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"budtbzwsan.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bugfabdmct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bugiohxele.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buhssgwshi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buildclerk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bukidnonmockpolls.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bullettrainbtn2.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bullettrainbtn4.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bullettrainbtn5.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bund-de.lojaintegrada.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buralenergiasolar.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"burftjmuwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"burlsxzpmz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"busanopen.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-alert-page19285.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-appeal-page12632-2512.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-appeal-page12632-2512.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-bt1.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-btbill.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-copyright-appeal-1285.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-fb-review-182765.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-fb-review-182765.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-00-258912.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-00-258912.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-00-519792.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-00-519792.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-10-028591.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-10-028591.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-11-687349.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-11-687349.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-12-052125.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-12-052125.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-12-085091.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-12-085091.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-120606252.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-12076-952.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-12076-952.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-122-92386.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-122-92386.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-1260-0963.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-1260-0963.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-129-06200.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-129-06200.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-1900-0072.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-1900-0072.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-violation-126-98.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-violation-126-98.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-violation-128622.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-violation-159715.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-violation-18-359.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-violation-186715.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-violation-186715.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-violation-187625.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-violation-187625.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-violation-19-331.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-violation-192869.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-violation-197-62.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-violation-218752.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-violation-28-666.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-violation-298942.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-violation-9218-5.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-violation-921869.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"businessbt-btcoms.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"businesscommunication-bthub.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"businessv148384237479restrictedviolation.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200002841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"busnzzpeys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bussines16r1d0478347restricted.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200002843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bussines19r4f1478967675restricted.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200002844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"butteryincomparableredundancy.pruebakskdf.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"butyvansoldskool.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buwagycfug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buwfafqrmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buxsvxjgzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buzaoujtir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bveywgdrmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvfgazbzvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bviklpedvv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvjfwsyksm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvlfkqqnbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvlubijhdf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvtgvejlnk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvugwjubni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvwexibkej.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvwvndgbjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvxigttdfb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvxwjfhgbc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvzmmsqqns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bw-informationen.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200002864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bw-kundeninfo.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200002865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bw-kundeninfos.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200002866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bw-sms.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200002867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bw-stornierung.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200002868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bw8zgq.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwaamuscpc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwatzoqbmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwctqakhbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bweqfllauj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwhnxxrukr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwhriqekyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwiflpbktf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwjyfmrrzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwsicherheit.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200002878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwsugkyvmp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwubbpbdjj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwwpbncmxb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwypkdyxxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwysmywjbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxgqxsmctg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxmlvnqerh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxpbdzjwts.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxvchhuvya3.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxwccqvklw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxwfjgtpuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxxgshfciz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxzvpittru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bybte.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200002892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"byglmglrhg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"byimnewtgf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bynpywdcny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"byringenieros.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"byrvtdgzgf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"byslgrfzrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bytefx.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"byvqtjqvef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bywafdtaxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bywleuxckr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"byzxtnskin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"byzzrjrdjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzcpoxbvbi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzdzjqwdux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzfpudgoxv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzhvzubmpr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzkccctbuc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzletxicce.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzmeisynwy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzohhoiauh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzotecdqjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzrbnapblt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bztqpbzxhx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bztyojyelr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bztzgyewiw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzuidgjpmt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzxiuwtdnf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzygrrfyfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzzzhbvxzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c.curiousmorty.be"; content:"Host"; http_header; classtype:attempted-recon; sid:200002922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c.gibsonwine.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c.loveawaits.be"; content:"Host"; http_header; classtype:attempted-recon; sid:200002924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c.mail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c1christine.tjelmeland2e.cso.gov.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200002926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c1qhhgql1z.map.azionedge.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c20f0789f73545650ebf57fa7dddc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c20f0789f73545650ebf57fa7dddc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c2dcw069.caspio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c2hch255.caspio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c3abh425.caspio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c6ebv708.caspio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c7d8fcc775c13766835eb0481e1c9.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c7d8fcc775c13766835eb0481e1c9.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c838d141661e86782cebe369822.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c838d141661e86782cebe369822.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ca-italiacontorevisione.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ca-italiawebcc.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200002939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ca24credi-agrlcole.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200002940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ca65t4498313.sitebuilder.name.tools"; content:"Host"; http_header; classtype:attempted-recon; sid:200002941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caaefxyhuv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cabanacotulariesului.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200002943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cacfnd.cam"; content:"Host"; http_header; classtype:attempted-recon; sid:200002944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cache.nebula.phx3.secureserver.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cadnreemnh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cadzbwacmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caeauweqro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caervymyzg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cafu-google.be"; content:"Host"; http_header; classtype:attempted-recon; sid:200002950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cagomweljk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cahxvxovdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caisse-ce.devupdadfr.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200002953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caisse-ingbe.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caisseing-be.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caisseing-be.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caisseing-cab8a.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caisseing-cab8a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caisseing-error.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caisseing-error.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caisseing-fd099.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caisseing-fd099.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caisseing-home.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caitrionaflynn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caixainfos.cargo.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200002965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caixaregularize.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caixaseguradora.quadientcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caizbnbkud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cajaarequipa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cajabanrural.negocio.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200002970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cajarequipaserv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"calable.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"calgaryren234tlistwca.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"californiaprincipal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"calm-bakum.mchkkbny.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"calm-bird.media-personal.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"calm-lab-e74a.cattaleya76.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"calstateedu.securevdr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"camaxtesmails.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"camaxtesmails.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"camerquiz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"camhencshf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"camineri.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"camiseta-verde.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"campingdelacourt.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200002985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"campus.hbchost.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"camrey.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"canadavisitisrael.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"canal-clientes.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"canal-clientes.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"canales-cmr.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"canales-cmr.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cangkulang.dnset.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"canpost01.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"canpost01.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"canpostpackage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"capedwondereurope.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caphvphcwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caracasmateriais.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cardanostake.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"careerbuilder-24a98.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"careerbuilder-24a98.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"careerbuilder-52038.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"careerbuilder-52038.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"careerbuilder-dc3f1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"careerbuilder-e73b9.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"careerbuilder-e73b9.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"carlos.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"carpediemxp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"carrement-bon.be"; content:"Host"; http_header; classtype:attempted-recon; sid:200003010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"carrinho-produt09811.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"carrion.etc.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200003012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cartaoplazablack.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cas-polygon.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cas2323233.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cas2323233767.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cas2328743.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casadoborracheiroxx.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casanaturalle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case-id.19786543621962.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case.96656282262.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case.id10002898563462.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10002361316.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10002361316.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10002616111.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10002616111.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100036443676721.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100036443676721.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1000423621661.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1000423621661.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10005415641518.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10005415641518.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100105610851085.adsreview.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1001056851150.adsreview.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1001856184151.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1004300386.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1004300386.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100451485222510.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10050156105058.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10050156105058.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100510541265100.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100510541265100.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10051895201020.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10051895201020.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100520011528541.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100520011528541.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100520132122612.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100520132122612.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100520651321652.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100520651321652.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10052210520546.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10052210520546.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10052455185674.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10052455185674.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1005256542015185.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1005256542015185.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100542102310523.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100542102310523.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100543765456.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100543765456.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1005618510981502.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10056216532150.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10056216532150.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10056321051054.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10056321051054.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1005643859565.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1005643859565.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1005810852150.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1005810852150.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1006505181895651.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1006505181895651.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10065203210662.ad-restricted.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1006526525866.ad-restricted.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10065624458904.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10065624458904.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10069158710489.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10069158710489.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100695265418023.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10095258410510.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10095258410510.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100962085634120.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100962085634120.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10098410451087101.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10098410451087101.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100984156514650.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100984156514650.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1009841851085.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1009841851085.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10502036121.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10502036121.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case984932423.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case984932423.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casefb.id10002898563462.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casehelp.28347213876.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casehelp.id1000257642165.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casehelp1000437865789607.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casehelp1000437865789607.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casehelpid.28347213876.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caseid.454654321131.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caseid10052347862364.adsreview.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caseid4785055283customerservice.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caseid923874238921.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caseid923874238921.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casemetahelpsupport.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casemetahelpsupport.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casgte-dsecd.zzux.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casobrou1111.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casomicrosoftco7.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caspmhmacm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casvpqjyni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cateringfoodanddrinksupplies777.business.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"catkin-brindle-houseboat.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200003112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"catur.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"catus.cat"; content:"Host"; http_header; classtype:attempted-recon; sid:200003114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"causelesshappiness.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cavabienalley.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cavea.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cawrokurte.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caxkuzlcfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caycos.beispielseite-wmka.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200003120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cb3da7d0-efbf-42a5-921d-fff43e63bc26.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbckmwtzmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbgihntsys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbhou91px.fiswebdv.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cblmvburjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbltbmveim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbnejbpbkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbplnifdud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbprnmcadd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbqcmuuwgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbskateshoop.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbwnujxxrl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbyywraenp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbzrdracog.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccavbipysz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccbewjzjmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cccnzsqnci.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cccveoolsj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccdbgjpfrv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccedkswpip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccexhfamzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccgbsefwjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccjrlaw.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cclnxdrzov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccloedrybz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccmwdxfhsn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cco-m.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccoeurblanc.mom"; content:"Host"; http_header; classtype:attempted-recon; sid:200003148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccomfzjdtl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccorsrfkee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccwzclvwci.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cddsjspmlu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdecornella.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdemp.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200003154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdf.cysa5ey.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdhk9i.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdiedmcevk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdlvfwocxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdn-32965.airbnb-onelogin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdnajxqnxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdnhfzqtkp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdniiervum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdrewdgmgh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdsxxsdeux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ce16531a-f304-4840-ba1c-81f4855c212b.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cebpr.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cebvzvjqow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ceccinmyee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cef8vwt7y9h.typeform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cehwxzagqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cejfrnnafb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cejumzbkpk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cekih9.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"celmiksurkatasa.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"celukpvhuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"centermanagementsupport464587.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"centermanagementsupport5656565698.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"centraforce.health"; content:"Host"; http_header; classtype:attempted-recon; sid:200003178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"centralfloridapaintandbodyshop.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cerbvpofht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"certificadosgobmx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"certificaweb.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200003182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ceslsptyvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cetzkulakk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cevwyapiqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cexvegpaow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfauaaoyam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfauzlubtl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfcanqfpfl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfdwkrfnrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfelfgqgye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cffdh.nnxzyy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfghh.lsjl120.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfgjloljmo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfjb.backify.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfkcgduaeh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfklpezpbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cflaxii.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cflkcwszau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfmtllqxlv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfqqkkcspc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfraternidad.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200003202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfsfmnzmiw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfvixkwtvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfvsyajrrv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfxxmadpsi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cg39009.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200003207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgagvvaxeq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgaozhavjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgcgzrptdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgcubvzjbi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgemfycqrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgkqsutwoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgkydwdanb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgmkdwuova.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgmketrngs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgmtmsmysz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgouguphnd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgruzbwtqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgrywuwgka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgtiorstnh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgtiuzvssp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgxpxgckok.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgywoikvza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ch-328328328832.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ch-483828832.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chain-sync.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chainofchanges.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chainswap-ecomi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chainwallet.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chalkerabeat.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chancey.byethost31.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"charlottjunkowalsh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chase-help-support-locked.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chase-onlinehelp.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chatficohhn.hinficochat.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chbuqzfyfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chcqnavhyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"check-10990099.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"check-status-31f89.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"check-status-31f89.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"check-your-status.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"check-your-status.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checker-102312789.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-50000264598754239709.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200003245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-10000000005269856326590.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-10000000005269856326592.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-10000000005269856326593.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-10000000005269856326594.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-10000000005269856326597.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-10000000005269856326598.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-2000000005698632659850.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-2000000005698632659855.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-2000000005698632659856.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-2000000005698632659857.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-2000000005698632659858.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-2000000005698632659859.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-30000000025693459865849630.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-30000000025693459865849631.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-30000000025693459865849633.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-30000000025693459865849636.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-30000000025693459865849638.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-3000000256934695986530.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200003263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-3000000256934695986531.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200003264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-3000000256934695986533.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200003265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-40000025631526895621365987.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-40000025631526895621365989.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-6000000006589746325685630.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-6000000006589746325685632.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-6000000006589746325685633.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-6000000006589746325685636.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-80000000365948596325936972.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200003272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-80000000365948596325936974.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200003273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-perbaikan-akun-fb11.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint10009.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200003275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail25.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail25.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail26.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail26.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail27.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail27.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail28.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail28.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail29.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail29.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail30.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail30.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail31.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail31.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail32.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail32.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail33.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail33.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail34.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail34.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail35.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail35.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail36.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail36.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cheeky-rascals.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200003300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cherrr12.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chfjkfunow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chfppzmvto.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chhatrapatitimes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chhoxyihyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chicagotrolleyservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chicoelectric.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chiddingstonenursery.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200003308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chikkuthomas.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"china-gear.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chinmayavidyalayarspuram.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chiragrajoria.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chitraprakashan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chjjiniwga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chjptwlbfy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chkcaptcha14.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chkcaptcha16.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chkcaptcha17.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chkcaptcha2.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chkcaptcha8.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chkcaqoacr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chkredirects.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chois.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200003323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chounbressn.hostenko.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chrgmqafdr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"christophebarre.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chutlincrapo.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chyjrrofys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ci1ltnz8.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ciawjkonzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cibjvosadi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ciceqjiwdz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cidevttewx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cigockwivo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cihocrvldq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ciitiezen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cijuahylbr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cijwuukaie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cikzpoatfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cimeronline.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cimeronline.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cimeronlineiadesistemi.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cinethiagende.cinelegende.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200003343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cinselsohbete.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cintasejatidrink.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ciojahcpmw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ciovnlkgcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ciqqqzcpuv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cirious.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cirrilla-stripe-form.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cirrilla-stripe-form.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cisfmwihxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cisrznlecr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cisteodpady.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cisyvrmrld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citapreviabccr2022.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citi-b39ca.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citi-b39ca.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citiibank.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200003359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citionline-aouth86c0.query357.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citiyibank.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200003361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citizengirlscollegebtc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citizensinfo.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citulje-pomeni.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"city-of-jazz.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200003365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citztnvyonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ciudadanoseguro.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200003367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ciya2022.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cizn1b.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjebcbngxz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjkfbvzmqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjlmofwqez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjlyenpkjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjmjociuch.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjmyrtnpau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjnjvxtwib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjntqxlzai.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjpefxinii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjpgxmcoja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjswesgtvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjveilxnrn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjwjpyhkyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckbdbwcwjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckbrgdtwco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckbyanwcze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckegqytwkj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckfhygrwvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckibdvcsdt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckkihskcog.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckkuuknwbj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckoqotyqau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckqiblrcna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckrrfimiwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cktbiofars.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckwextkxlo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckzacnvsjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cl-hnc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim-online-irs.x24hr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.refund.s52gv.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.submit.r45a.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200003400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.submit.s20k.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200003401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.17f6e.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.amanded.5zy0my1.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.amanded.q74u0dn.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.amanded.ui0rb.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.amanded.umfiduu.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.amanded.wtz1uru.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.amanded.yumbass.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200003408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.llgca.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.oetnh.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.q20a.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200003411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.q41s.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200003412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.r96a.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200003413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.refund.6evd0t2.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.refund.bpd7eay.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.refund.cl0ue.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.refund.d849a4l.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.refund.mj0tey4.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.refund.r3k0u.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.refund.sgwb39q.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.refund.swmhyf6.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.refund.vu65m1t.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.refund.wgynxn9.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.refund.ykrdz.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.return.5sbfb21.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.return.79l75.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.return.7bfwbgu.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.return.aqh28n9.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.return.dk2f3qk.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.return.kgcs1mj.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.return.l280qko.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.return.otyvu6o.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.return.rexdb33.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.return.udnf7de.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.return.zslwq.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.reveneu.u6cty.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.service.2ucaebr.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.service.6evd0t2.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.service.aox8e80.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.service.b9ffekf.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.service.dynamos.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200003441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.service.vgxqczj.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.service.xh1qxcf.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.taxservice.49dz68l.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claimsolana.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200003445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clartelive.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200003446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claspogrix.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"classiceyewear.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200003448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"classitaupy.evxx.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claus.bz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clayzhqwsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clbejowrwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clblink.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200003453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cleargalaxy.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clepper.exchange"; content:"Host"; http_header; classtype:attempted-recon; sid:200003455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cleverlandbuyers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clgnrscknt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clhrbiltty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clhuvpxgct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clhxqxqwis.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"click-here.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200003461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clicklo.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200003462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"client-particulier.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200003463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"client-servicessupport003.oznemedya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clientele-boursorama.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clientenjoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clienteperfil.bradapp.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clienti.accesso.sicuro.youthnest.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200003468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clientmail11.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clients-portal-dkb.serveusers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clients.devtux.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cliffordchnllp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clinicadelcomputador.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clip.suckhoe.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clockurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clone-7473c.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-based-preview.shared-fileees.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-based-shared.line-assets.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-documents.member-datings.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-preview-doc.zip-sneidjer.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-preview-shared.auth-sahidoc.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-private-project.progrest-auth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-project-august.media-love.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-project-folder.files-progress.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-share-file-drive.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-share-file-drive.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-shared-folder.preg-remit.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-shared-preview.pre-signen.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-storage.files-recruitments.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-ways-document.confidednt-auth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud.onlineapp.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200003491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud102.hostgator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clouddoc-authorize.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clqajikunm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clqmuvydnm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clrxappnad.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clselqokks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clt1432536.bmetrack.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clt1448359.bmetrack.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clttmyvqbw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"club.idea-world.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200003501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clubeamigosdopedrosegundo.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200003502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clukdwjdpb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cluqdnzxzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clxgqvpkht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clxluhbbvi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clxsy.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clyharaldr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clyuddokep.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cmbrczlavp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cmdcdvagtp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cmdfdrecoveryapges10000228.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cmggnmpm-69031.docauthshareportal.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cmkplyzaec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cmvezefvai.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cmyudthibh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cn4e-69e69.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cn4e-69e69.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnaewsvxwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnazzzmydc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnbas-log.mobirisesite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cncqsoocup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cndrbwyhoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cndsgxogok.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnemacvojc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cner283829.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnfrmacn.hprusak.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnjeuidvfz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnjmxgnaqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnmolwxeou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnn-cameroon-fb-1eb71.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnnketuwpc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnvaxxjpqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnwvvgndxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cny-shopee.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"co-il.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"co1up1date.z13.web.core.windows.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coachtrainer.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200003538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coc-blog.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coda.prmm.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200003540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"codepasta.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cofqfknguw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cofrhjhbum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cohssfvtea.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coin98n.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coin98n.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coinbasedefi.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200003547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coinbazer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coinmarketscope.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coinpayu-adres.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coinsolutionportal.best"; content:"Host"; http_header; classtype:attempted-recon; sid:200003551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coinssolutionrectification.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coiuuxfzed.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cojtpqdilw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cokerconsultancy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"colcentralnew.procesardatos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"colegiopaulovi.edu.ar"; content:"Host"; http_header; classtype:attempted-recon; sid:200003557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"colis-bpost-be.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"colis-bpost-be.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"colislaposte.wonstasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"colobor.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"colpatri.verificacio19.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"comerica-rfy.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"comerica-rfy.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"commbank-auth-id.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"commbank-help-849c3.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"commbank-online-au.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"commercecitymovers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"commerzbank-phototan76z2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"commerzbank-phototan76z2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"comnitytermsrevicesocials2022.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"companybrazilmail.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"complementosicop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"complianceassistance.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"comprind.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200003575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"compuclon.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"compute-cloud.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200003577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"computer-4all.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"comunicazionebper.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"comunicazioneclienti.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"comunitydtatermservice2022.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"concernant-lacceptation.com.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200003582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"conexaonautica.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200003583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"conf.chuuu.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"configsure-admin.zzux.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confirm-your-identity.epizy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confirmacion0utl0ksecu.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confirmaciondecuenta-c30e.czemarkojo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confirmacionesgad.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confirmar-bbdba5.ingress-erytho.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200003590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confirmationgetstartedservers.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confirmationhomehondura.bancatlanhome.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confirmatucuent.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confirmmaso.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confrim-account-pages.epizy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confrim1000001.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confrim1000004.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connecct-login.bulgarianescorts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connecct-login.lei-instyle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connecct-login.lumiere-h.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connecct-login.seitensprungaera.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connecct-login.willworkforprofit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-au-login.updateb1.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-au-login.updatebn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-au-login.updatebn.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-au-login.updateee.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200003606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-au-login.updatrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.boatoryacht.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.calidadtech.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.dragoneygaming.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.ellistrator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.fidgetdesigns.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.fuelprobes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.gamerspride.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.hamidfalahati.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.haulagevehicle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.ideadigitalwsi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.kdarisalon.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.lgmsecurity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.malakatogel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.mantasyisland.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.margaretreilly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.more4life2day.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.pawstothewall.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.procalldialer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.pumpituplive.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.riscatoolhire.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.rs485pneumatic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.sanalfilozof.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.sillygirlranch.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.totsukafumiaki.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.yourtennispal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.yukiyamagirl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.zurichotels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-validate.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect.openchainsmart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect.validatorsecure.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connecteam.sudsafe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connecteespaceweborange.mystrikingly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connectwalletvalidator.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200003640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connexion-sfr.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200003641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connt-w-t.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connt-w-t.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"consegnacarta.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"consenso-spedizione-bper.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"consent.clarosgvas.mobicare.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200003646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"considerpublisher.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"construction-document.kit-ouath.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"constructoramyc.cr"; content:"Host"; http_header; classtype:attempted-recon; sid:200003649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"consulta.miconsultaenlinea.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200003650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"consultarhiperpdf.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"consultas.mbpersona.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"consultas.miareacliente.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200003653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"consultas.zonaconsultas.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200003654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"consultoriadigital.pwgirona.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"contabilidaderabello.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200003656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"contact-noreply003-my-cheetah-website-1.cheetah.builderall.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"contact-sfr.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200003658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"continentalproducts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"contrataes.sslblindado.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"control1-bnl33.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200003661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"controlloallert.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"convalidanumero.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"conversion.qhigh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"convnvatid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cool-queen-7743.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cool-sun-00a2.wessternroade.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cool-unit-8dd6.whybed6896573.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copymint-blog.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-appeal13184837.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-appeal13184837.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-appeal213914784.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-appeal213914784.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-appeal9317931793.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-helpcenter123131424.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-helpcenter123131424.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-helpcenter1289037189.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-helpcenter1289037189.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-helpcenter15689135.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-helpcenter15689135.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-helpcenter23178920.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-helpcenter23178920.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-helpcenter561679314.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-helpcenter8513589522.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-helpcenter8513589522.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-supportcenter5618237.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-supportcenter5618237.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-supportcenter7562813.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-supportcenter7562813.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-supportcenter8731639.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-supportcenter9134833.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-supportcenter9134833.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"core.pdf-asset.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"core0000003-8e51c.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"core0000003-8e51c.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"correctionconnect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"correctionnode.services"; content:"Host"; http_header; classtype:attempted-recon; sid:200003697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"correo.pancakesvqp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"correos-es.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"correos-es.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"correos-package.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"correos-package.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"correosadmin-bb18ff.ingress-bonde.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200003703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"costaricaprueba.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"costaricaretireonss.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cottonwooddentalg.nimbusweb.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200003706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"courtcase.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200003707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"courteousharmoniousgraduate.homebankingq1.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"couvilrxcj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coyhykhwgm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cp.digitalprocurements.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200003711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cp10.machighway.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cp56206.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200003713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpamcartevitale.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200003714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpamgouv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpanel.authenticate0.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpanel10wh.bkk1.cloud.z.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpclouddomainsecureserver780909876678656757788uutuu.reactification.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpdqkarkwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpdzzthlce.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cphamembers.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200003721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cphewcrfkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cphusymcdw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpjjosuerq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpjrdflgml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpkgrfwmzo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpmaxyenrl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpndanayfm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpptvbalni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpqkpxmvuc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpsbmesmhp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cptj6008.odns.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200003732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cptpvbgpmw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpxqihqdtj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpzwadwqrl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqgxjjiqdf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqhroggcwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqizsjpspu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqjinlejzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqmwoyzrkc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqomysfjun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqoropxcnq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqpeumndza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqsuipxnwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqtewfrqek.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqxkixvhst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crazy-taxi.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200003747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crazy.nbce9.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crbygapxst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crbzgvugfy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crbzlqjdbg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crdcvbjksp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crddixsspd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creative-faint-mitten.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200003754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creativeani.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"credifinanciera.didacsis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditagricole-sudrhonealpes.blogspot.ba"; content:"Host"; http_header; classtype:attempted-recon; sid:200003757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditagricole-sudrhonealpes.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditagricole-sudrhonealpes.blogspot.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200003759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditagricole.bank-online.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditagricole.djenanenoor.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditdunord-session.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditdunord-session.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditiperhabbogratissicuro100.blogspot.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200003764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"credito.prestamosonline.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditphds.credit101main.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditsuisse.bluproducts.com.py"; content:"Host"; http_header; classtype:attempted-recon; sid:200003767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creiomdino.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crematoriolitoralsp.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200003769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crgbybnwco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cricutcomregister.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crimson-dawn-bc08.bizd134.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crimson-snowflake-5a43.anyrag8021015.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crimson-truth-b81b.jefferyscatering1615.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"criticalexhaustedautomatedinformationsystem.mathiasperezcd.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crjhutpupm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crm-galicia.snet.ar"; content:"Host"; http_header; classtype:attempted-recon; sid:200003777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crm.epochfinancialus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crm.rlzinqhftp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crmobepqny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crnnloazvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cromexa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crookedfatencion-usuario.usua7br.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crossoverbrazil.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crownsys.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crrqcsjass.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crsdidbrhj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crtrbduyiu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cruizwdxzr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crypto-trustpads.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptoassetrecovery.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptocar.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptocarspro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptomining-experts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptonvest.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptoplanes.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptvalidate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crystaljourneysad.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cs.k3pu0ux.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csd.pyvwypl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csdfsdgsdgsd.sdfcsdsfsd.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csdxlkxqrd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cse-syneoshealth.opence.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200003803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csfbssfuot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csgdf.6gse0t.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csgdn.mqjxaho.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csgnqgkwof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csgofloat.com.cm"; content:"Host"; http_header; classtype:attempted-recon; sid:200003808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csgofloat.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200003809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csgwvorkjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cskplxmhyh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cslektqdzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csmduqclyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csopvoefop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csytiyzgli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cszs.jdqrpzo.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctbkqfwuuz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctdrpsiqdm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctkopcnrop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctkxvdubwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctmredirapp.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctmredirapp.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctovrnyozi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctreswhkcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctsylnk.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctt.deal-guard.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200003826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctttqdqulu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctubujygar.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuadrosasociados.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200003829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuaiucntgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cubbychase5k10k.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cube-me.cam"; content:"Host"; http_header; classtype:attempted-recon; sid:200003832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cucakdental.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cudnpicemg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuercnesxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuiveymeeo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cumitermiska.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cunamutualconnect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuoyewlulb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cupom-6-meses-aproveite-semana-consumidor.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cupomax.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cupuetvpgv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"curly-field-bd79.wareareto.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"curly-fog-aa13.breadgold8885649.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"curly-paper-7426.m-2-31.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"current-evanescent.dvrlists.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"currently-102595.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"currentlyatt.boxmode.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"currentlycom-atandt.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"currentlycom4.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"currentlymabrylink.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"curs.expert"; content:"Host"; http_header; classtype:attempted-recon; sid:200003852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"curtismscaparrotti03.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200003853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"customer-admi-acces.autoescuela-aguilera.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200003854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"customer-p.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"customer-p.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"customersde-support24.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200003857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"customerservice-package.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuxhbmdigz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuybitr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuyqmyrals.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvblniuiho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvciaqyjfr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvedajghrewa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvfphgxkli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvgsafrwsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvijvfwkju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvjaqitrrl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvkonnkblp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvmwqoonmi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvnuhvjpgt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvnvdvuxif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvpiuxwphh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvqaffxnhm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvqzvgvgen.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvrieihfru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvtsybumxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvumwrqtnm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvvesuvlal.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cw02466.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200003880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwailygllh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwar9.enviodecontrato.digital"; content:"Host"; http_header; classtype:attempted-recon; sid:200003882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwbwka.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwbwka.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwdrwdxmus.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwdyjhaidh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwhdlwcdwj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwluriojtj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwnlvfpwdi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwoejrkmac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwpnpsujoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwusftmqpj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cx-mooeny.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxaugmrwln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxbahoisqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxdgfewyhthg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxkxymxvls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxlsqfhxzq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxltquksqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxodkdxjeq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxoztqrbsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxs.vlngnlm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxs.xas7y4w.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxsd.mbjwybw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxsxcxtuyachsxcx.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxtrdbkhie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxvfd.pax3tpu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cy75363.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200003908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyakyxvcrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cybrqerrgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cybrrcwcqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cydwbs.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyhtsqgerg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyhxkmbgzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyiotjvizp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyjeangock.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyljhzuaah.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyploczuix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyqwxndchv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyumyeehkx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyvsbobwch.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyxkkjwafq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyzhogeiqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cz.ceskysystem.accountantsmart.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czcyodtwlo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cze43.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czfxtqbxyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cziwaeoxlt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czjurbayrh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czkanfbdsi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czkprjisjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cztpmrdkos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czurmkyrhw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czvon.4fan.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czwrbbugsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czyvsmwiwd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czzmyuefrs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d-k-b-12-09-2022.from-nc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d-k-b-18-09-2022.from-nh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d-outlook3930034.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d.app01988.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d.edgecryptobf.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d.jxted.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d.oftde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d2c73chukiedd6e8b975e5441937c.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d2c73chukiedd6e8b975e5441937c.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d4303943-31.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d4303943-31.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"da.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200003949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daafevevjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dabancolvalidat.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dacetnroj-gemes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dachnaymgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dadaotravel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dadjtxwuix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daifiijdjfsdfeporwe.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daiichi-gakki.co.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200003957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daiixlloph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dailyclaimnows.run.place"; content:"Host"; http_header; classtype:attempted-recon; sid:200003959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dailygames24.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dainikjeevan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dalemcmanus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dalsekfelj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"damp-brook-ef1f.wm9t6yeu.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"damp-cell-b538.walkingvibe0036866.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"damp-dawn-51e1.nicholasa.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"damp-f43e.recovery-page-secur.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daneves.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dangerousuniquefile.gfdgdfh.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dangol-v2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapconnection.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapp-solution.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapp-solution.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapp.activationaccess.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapp.busta.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200003975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappai.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappbridgeprotocol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappbuilder.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappconnectpad.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapplinksync.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapps-live.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappssynch.win"; content:"Host"; http_header; classtype:attempted-recon; sid:200003982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappsync.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200003983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapptoolsolution.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daqpvexhlm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daqwpiskfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dar.kupabaruak.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dark-base-6f49.dotmay820.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dark-boat.media-peoplle.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"darsomars.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dasfujxqwg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"datacekiussuesmanaged112067.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"datacoresystems.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"datarecovery-fl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"date-update-ups.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"datosonlibankingarg.login120.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"datrindo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"davidavidavidq222.notisfia.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daviiviiendasiempre.daviviienda.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"davip2022confirma.daviplata2022.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"davipcosegurd.daviseguros.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daviplatainforma2022.daviplata252.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daviplatainformaa.daviplatacopp.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daviplatainformacion.activoacgivorec.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daviplatasegurainformacion.daviviendausers.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daviplataverificacion.servicio1.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"davipltapersons1.servicios1.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"davipltpersonas1.confirmacioens.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daviseguridadoperando.winner23iennd.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"davivielineaplus.lineadavipluush.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daviviendaclave.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200004011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"davpemrcus.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dawert675432.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dawno.ciwumugiasda.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dawq.wlyhxj477.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daycoval.contrato.srv.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200004016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daycoval.facildepagar.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200004017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daytrading-wallet.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dazjwuuvsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dazzling-hummingbird-8be042.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbcsugddqo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbdbdbfbfedefeg.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbenpquyia.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbenpquyia.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbglhovdgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbhlohalgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbijmudqgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbolsmwyoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbomgjhleu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbqfwjdoma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbrxyncmta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbs-singapore.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbs.help-support-sg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbspvwqpew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbwqnflupo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbwsedilym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbybgadsww.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcauaomnqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dccjmhtnqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dccrrvuiiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcfhgvhshh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcfkfvddga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcg.fq0vj4j.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcgdhwnzwy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcgpavkkoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dchpfkgvir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcoknvtqgp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcoxjiqata.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcqolwbozn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcrqotmaed.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcrskrggnh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dctitan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dctrzlektt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcwuibvxvz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dd1b31ee8fa4b8d16cf300f4e8222e.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dd1b31ee8fa4b8d16cf300f4e8222e.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dd90001.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dddszrlgiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddenekudzh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddfgh.npdmsro.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddfmkjtaxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddfrszvbqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddietmhqom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddiouyyhcy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddjqsqllhp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddjzgiuyhg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddlzeltjgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddpsgickyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dds.rvgnmnt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddsdouvfal.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddsghrpcyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddsjpacxtb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddv.irwsis.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddwlwgjlei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddxlunnnwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddyhplhkmp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddyjqfxyzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddzxeocqlx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"de22c9kukppr.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deafhuydsf.mefound.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dealsadvise.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deasdafdsf.2waky.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deayygwccd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"debonair-showy-puppet.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200004084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deborahholland.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"debugbyte.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"decentralgames.wl-limit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"decentraqames.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"decentrskal-games-on.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"decrocheur.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dedetizadoracleansos.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200004091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dedikkboac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dedqeaxlag.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deekshabhoomi.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deexvrgmjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"default-132423530.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200004096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"default-132423531.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200004097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"default-132423532.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200004098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"default-132423533.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200004099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"default-132423534.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200004100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"default-132423535.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200004101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"default-132423536.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200004102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"default-132423537.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200004103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"default-132423538.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200004104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"default-132423539.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200004105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defensajudicial.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200004106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defgwvniqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defh.7x8sp9.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defi-aavev3.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200004109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defi-aavev3.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200004110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defi-aavev3.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200004111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defi-go.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200004112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defi-mining.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200004113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defikingdoms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defilo.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defiprox.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200004116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defumxzxkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"degerkromaj.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200004118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deguidesrv-customers.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200004119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deintiershop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dejmibavvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dejpaad.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deknolifyu.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delbarriovalpo.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200004124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delezhen.mashalezhen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delhiescort69.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delicate-bush-0904.rcvrypahsajk.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delicate-dawn-reganba.vb2jdb03.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delivery-0lx.315421211.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delivery-dhlmanage.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delivery-dhlmanage.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delivery-elta.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delivery-elta.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delivery-incoicedhl-jsh6813604.codeanyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delivery.attempt.failure.asherq.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delivery.attempt.failure.saliscreation.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delivery.attempt.ndelectric-dz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deliverydhl-invoice.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deliverydhl-invoice.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deliveryurequestclientxservicessupporsps.oznemedya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dellabruna.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200004141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dellannohomedesignva.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dellver5ollxpolska.pln-dostawkanens41.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200004143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dellvers-inport9polska.peydostawahome58.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200004144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deluxify-ff527.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deluxify-ff527.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demasiadoloco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demo.bradescocontrol.vertitecnologia.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200004148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demo.cmtech.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demo.giamso.com.sg"; content:"Host"; http_header; classtype:attempted-recon; sid:200004150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demo2.cloudwp.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demovp.cruisesmekongriver.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dentallabor-morgenstern.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200004153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deny-attempted-login.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"depjabruxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deqrmcseel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dermrbtlyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"desarrolloturisticopartidordelsol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"descontosespeciaisclientes.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200004159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"designcast.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200004160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"desimvtjmt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deskorganize.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"desplugado.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"detflcuitb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dettawnber.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deutcher.easy.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-corporacionbion.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-corporacionbionline.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-cxblopp1.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-galiciajomesecrys.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-ghuopcs.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-hbvcffes.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-homeitau-seguridad.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-imapoztaswiss.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-industrialbionli.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-nadaj.orlenpaczka.ce5.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200004176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-pliodustrilamesn.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-www.orlenpaczka.ce5.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200004178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev.api.cal.ukpbj.codelogic.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200004179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev.matrizeducacao.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200004180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev.pagseguro.qisar.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200004181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev.tax-pol.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200004182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev.technotackle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev3523.dauuvfhrbd1p9.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev5924.dxxsgb6hsq3ex.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev7029.dxxsgb6hsq3ex.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev8002.dot5sis18w0nf.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev8804.dedccw9t6lm0k.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev9448.d1clnipioz5myo.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"developer-sendgridapp.azurefd.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"development.aisecureme.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"development.omefyi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"devineair.smkcreations.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"devnet.d2qjc5gl0rx42s.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"devpackaging.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dewdaa.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200004196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dewzhxaubw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dexfixrestore.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dexrectification.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deylwwmrld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dezemvbmhv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfbae971-92df-46e7-b6aa-47dee1d59a1f.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfbfd.75263.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfcevdjnkfbhjvdg.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfdhdgjsd.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfeldjpfem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfesrtbyow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfexmjdufx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dffs-drsfer-ftreeryt.agilecrm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfgg.hq-smart.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfggh.htkvjwluwx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfghh.htkvjwlgahj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfghh.wuyueducation.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfghj.lyuvkgs.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfhalplcgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfhjj.irg70nt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfhlavhlok.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfhxrcsjbb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfievlpejn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfjffvfazj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfjzzxasvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dflafgpgvf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfmbkctoif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfmixlomzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfmkdnlxxv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfnkoodgda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfsvmhejgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dftojc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dg.efcgjgq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgadagadating.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgdgvbfbgnnnggn.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgfgkzayie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgfh5344ggdf54er.mydopweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgfoodsnet.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dggqhvbdug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dghjj.hhxxh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgjbqvklvg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgjhdlirdg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgkrlgwcne.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dglnqabeip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgnalkprmg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgoqyqalxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgthyrdthrds.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200004243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgtnzpqmxt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgu9g3a2kzqx2.cloudfront.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgw.soundestlink.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgwkvqjpyn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgxkxzqcyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgzjeigxxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhamfwjkez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhanushr24.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhcsnjqehd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dheeh.so"; content:"Host"; http_header; classtype:attempted-recon; sid:200004253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhjaaxkmev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhl-event.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhl.de.carbisbayoceanclub.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200004256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhn.zccf64h.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhtgf.pjg3le1.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhxh.2b9iz31.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhysggxrae.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"diadaoportunidade.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"diamond-gratis-terbaru-agustus.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"diamondalied.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dicantrelend.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dice-20a85.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dice-4399e.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"die-post.softr.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"die-postch.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dieetpsovo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dienergia.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200004270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"diftgwicmh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"digiboxtest.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"digiibuy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"digimaine.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"digitaglobal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"digital-fatura-setembro-br42.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"digital.abcsemenstation.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"digitalhub.westrock.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"digitalismkbhu.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200004279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"diksowe.uno"; content:"Host"; http_header; classtype:attempted-recon; sid:200004280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dikxjlyzzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dipdfdkvkj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"diqhibxwdz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"direccion219191.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"direct.smbc.co.jp.bjdrhc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"directnewszone.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"direitolcv.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200004287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"direx.is-great.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dirgold.easy.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discocock.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discordindication.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discoverdhaslkcxfinity1.560f866578.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discovervisionary.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discoveryartesgraficas.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200004294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"diskrpge.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200004295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dispendukcapil.bulungan.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200004296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"disponibleahora.assitecac.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"disponibleaqui.transparency-tv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"disrupto.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dissociadispositivoweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"distinctdarkredsubversion.josaperes.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"distinctivei.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"districtchronicles.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"divine-haze-2415.whybed6896573.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"divine-mouse-da46.kontor5687.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"divine-sunset.p16t2853.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"divino.zxinomoiszer.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"divorcelawyers.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dizjutvkcv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dizzylostemulator.galihomeq11.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djbingproductions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djbmdll.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djbsgjpkpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djcdklgbvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djcelio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djdtllerod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djfkmoqmee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djfofwqjbn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djfvjkvygu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djidfkpwgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djihyehfbl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djivsgethj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djmebjrrjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djnedbhopb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djnoqjlfsq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djohhlyhdn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djpowurhdj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djscordnltro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djtlgvkzsg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djytenygax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djznjvulcp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dk6k0z.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkb-bb8e35.ingress-daribow.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200004333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkb-daten.act-or.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200004334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkb-konto.digital-1.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200004335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkb-kunden.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200004336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkb-online-banking.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200004337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkb-online.wadsoncables.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200004338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkb-profil-updates.serveusers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkdbuiwmjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkhvddzxqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkksilaban.helpprotections.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkksitamjuntakk.martulangsore.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkkwrcyzpd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dklqwtiobb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dknbkzxlea.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dknusoinec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkocsrbsdu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkpcadfxgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkpost-yassirattobi1995965509.codeanyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkrc0up.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkrujcdxci.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dktcbiooal.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkuwuvqorz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkxcflnggl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dl.9xu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlbwhinpxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlcyjztfme.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlekqzvdgt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dloewynbpd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlrcfirgbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlroezdxfc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlscord-tm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlvfhkxvmh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlvtdrqusx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlxlepuptm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dm2.opq.pa-tarutung.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200004367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmarket.se.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmdecors.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmgfgnznwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmicgsldnd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmirouhvlj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmiyyufomq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmjrnyhvvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmkudjwspe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmlnpgjwdi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmosxpyyor.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmtqtavray.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmvhqjmefs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmvmimosrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmwwlgbmxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmwwsaquuv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnbauth4.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnbauth4.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dncobidorf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnggkvsizf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnhgzbdjzg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnmchcxjgi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnqnmlknvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnrebrfoss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dns1.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200004391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dns2.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200004392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dns3.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200004393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dns4.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200004394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dns5.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200004395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dns7.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200004396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dns8.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200004397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnss-3982f.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnss-3982f.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnvfbjxlky.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnwkgmgfyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnwvmsqact.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnwvpkuwii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"do-any-3.strangled.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doanmnmmmmbnmdffd.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doc001.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doccusend.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docdrive01060authorizesharingfile.onmicrosoft365.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doclab-console-auth.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doclab-console-auth.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docs-dew-6406.retupamyte.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docs.revv.so"; content:"Host"; http_header; classtype:attempted-recon; sid:200004412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docsharex-authorize.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docsharex-authorize.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-cloud-secure.piltrimuging.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-clouds.fuconbaetu.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-folder.chat-verify.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-private.direct-sustutelue.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-product.rototetiined.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-progress-asset.retupamyte.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-project-june.voicee-love.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-project.secure-count.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-projects.files-auuth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-shared-folder.date-oauth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-shared.datings-prev.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-update-progress.shared-filees.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document.lates-proposale.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document.storages-clouds.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document2c-f4e80.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document2c-f4e80.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document3b-d779b.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document3b-d779b.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document3e-e09ee.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document3e-e09ee.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document4b-8063c.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document4b-8063c.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document4c-aabc6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document4c-aabc6.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document5-153bf.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document5e-22051.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document5e-22051.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document6-23891.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document6-23891.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"documentoprotetto.filedicondivisione-909524fb9aa348b230295a2b7a842c21.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"documents.projects-june.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"documents.shared-authentiicated.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"documents.uvzcknthvfffqjzakuxgdrnthu.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docusign.mslive.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docusignredtail.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dofus-touch-com.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200004450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dofusforums.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dogorpkksy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doingusefulwork-87321.click"; content:"Host"; http_header; classtype:attempted-recon; sid:200004453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dokxevgjeu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dolipops.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dolphy.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dolunaytravel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain.x49v5.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domaincontroller.pmeimg.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200004459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg10.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg10.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg12.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg12.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg15.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg15.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg16.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg16.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg17.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg17.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg19.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg19.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg20.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg20.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg21.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg21.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg22.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg22.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg23.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg23.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg24.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg24.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg25.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg25.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg27.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg27.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg28.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg28.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg29.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg29.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg30.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg30.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg31.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg31.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg32.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg32.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg33.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg33.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg34.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg34.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg35.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg35.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg4.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg4.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg6.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg7.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg7.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg8.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domelnews.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domesmarketing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domino6b.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200004518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"donatea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"donateb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"donatec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"donated.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"donatee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"donnerbe-04.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"donnerbe-06.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"donnerbe-07.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"donnerbe-08.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doodles.mints-link.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dopqrwhbyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dotfkxwcld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dotggmapeo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dotsatoshi.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200004532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dotweb.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200004533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dovzdrpdxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dowaba-s2dhl.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"download-folder-files.secure-place.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"download.bitkubfy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"downscapes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doyypixfto.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpcpl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpd-shop.64874121.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpd.depotservices.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200004542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpd.itemservice.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200004543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpd.survalyzer.swiss"; content:"Host"; http_header; classtype:attempted-recon; sid:200004544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpdanrczer.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpfko-inv.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dphmxgksyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpkrbfrxuc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpm.usbypkp.ac.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200004549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpmasdaskj.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpncbxamrq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dppieeeejf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpqhcjnpkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpqxnrshkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dprmhrqvrr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpsyjmipjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dptointerno9021.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpuczctlta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpviieoyye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpxromhxih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpxufnfuel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpzorthwtd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dqhwyzllct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dqjvgjjfbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dqlzwjdgsl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dqnujvyghv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dqoigthygo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dqpfdmwqso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dqreorjixd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dqriybyduw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dqsfpyvljx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"draaggtfzl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dragarwaldentalclinic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dragoedilizia.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200004574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dragonflygraphix.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dragongroups.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drbazzpinx.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drbethwestie.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drdmnmmngz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dreamherbs.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200004580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dreamy-chandrasekhar.193-70-21-70.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200004581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dremondrebese.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dremondrebese.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drflvacxvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drgdyrrmam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drgwmkeqvm.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drittohub.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drive-file-device-local-disk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drive-file-device-local-disk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drive.dataexpertservices.hu"; content:"Host"; http_header; classtype:attempted-recon; sid:200004590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"driveequitypartners.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drjgpkzvya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drjrkgtydq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drlpcqiiay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"droits.typeform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drop-in-accountability.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dropbox.sudsafe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"droqbfvujk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drqpdcjixl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drsridharspine.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drtmyyttva.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drtoacceam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"druxpbytcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drvapp.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200004604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dry-dawn-acf5.jgomez2482804.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dry-naha-4740.staba.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200004606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ds.cczmlx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ds.tdj32v8.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsacjrtmmt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dscavzzgag.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dseerhqzzo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dserqhjyih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsfcdn.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200004613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsfnjpazgs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsgcbeonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsimtlqyac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsippglqyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dskuk.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsv.gpyletf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsvf.n6wum7f.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsvg.ctulrceo.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsvmmenrvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsvrzyoaab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsxvznpjaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtcxnhxyix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtkcsiyqit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtlieolgbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtlkzevhju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtmejdtean.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtmzcfilcx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtngfbmdiq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtnqgaswcx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtovkmulfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtuguiuygtrrh.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtxmcynjkq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtxygsylrd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtzzgimmfs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duahatii.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dubyutzduo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duhqufonix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duhrefalxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dukcglulir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dukeoffice365745dept.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dunescapital.ae"; content:"Host"; http_header; classtype:attempted-recon; sid:200004644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duo-ange.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duozfntknj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"durkle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duuxgeokmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duvwqormul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duxarzkmjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duxhqghqvp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duxwkyfqza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duyeadswyg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duyfdsuzie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duykonisitme.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dv.0b6iqq9.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dv.bj0b8g1.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dv.j0rkb3xh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dv.mmabive.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dv.wbirbuq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dv.xzcxgnv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvassociates.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvatbvkbba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvbgwuhywc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvceuhcjbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvchmwaqzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvdxmxhjaj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvenuaufjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvfbxyjrbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvhrvhdlbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvjstrvziw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvmjpdiyqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvoqctqjyh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvplhdhaek.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvpoyffvwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvs.0ygs5da.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvs.6nespp3.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvs.hjjxmfl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvs.lhsewdc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvs.mosytjf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvs.qsfxkea.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvs.xgrunrk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvs.yjkseus.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvtthnunzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvtznpmbho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvx.1yf55vl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvx.naxunbs.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvxvzhiwym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvzwtyfuri.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwblxrjsii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwevqgaeyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwfisceksu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwgnfwwdja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwlkgabtzh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwmjdcjfib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwnlpstdgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwpiwahzrl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwqcccrhfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwqdoyaglt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwzgxlkohy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwziastplu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxbmuxveao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxdhurlfrv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxdxdxe.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxfcvg.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200004705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxhcj.arwcbs7.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxipusdeno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxjvoymhjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxkqczgdtt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxlxtvmitj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxodxiyweh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxoflzszxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxspjxrwul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxxmmyy.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxxmmyy.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxxwiawpjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxyjqggniy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dybstxjuzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dydtaitxtl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dygsebmytf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dyguoczrba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dygwpkgrvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dyhyubbtol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dyilgcvbkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dyleeqbvvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dynastyclinic.ae"; content:"Host"; http_header; classtype:attempted-recon; sid:200004726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dysvoxjqxz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dytljdzamj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dyuvstyfawecteraw.blogspot.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200004729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dyvkfizjux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzasarlutg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzdrbhqsei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzebachonm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzexdmedcy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzgszyhzry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dztujxzqnp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzwgievria.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzycvayrvm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e-cassare.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e-monev.blitarkota.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200004740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e-smansa.sman1bdg.sch.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200004741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e-sport.bti-if.dk"; content:"Host"; http_header; classtype:attempted-recon; sid:200004742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e-surat.kominfo.tabalongkab.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200004743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e0406.miraclerichs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e1aae61c265532e4bd8a014d5391cde4-dot-office-352115.uk.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e41266ayuu.temp.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200004746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e4ra.byethost8.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e63q45f9h5fr.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e83e5ba2291017f22a7f2fe61c784339-dot-office-352115.uk.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ea6acd5e3d06efaa3c427414515806.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ea6acd5e3d06efaa3c427414515806.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eaazpxsvjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eager-fermi.104-152-223-140.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200004753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eagleeyeapparel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eaglestar.com.myelf75irfhajtm3egepywelf75irfhajtm3egepywelf75irfhajtm3egepyw.servicecareireland.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eajbrqqggw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eajxvtkhax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eaki-crent.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200004758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eakl-ceuzw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200004759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eakl-ncate.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200004760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eakl-nsure.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200004761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eakl-nsya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200004762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eakl-nuena.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200004763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eakl-reuow.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200004764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eakl-rsacz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200004765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eakl-seasw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200004766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eakl-seurw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200004767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eaqurhfzfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"earpainpedia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"easybit.z4od.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"easyweb-be.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"easyweb-be.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eavxmdopqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eaxcdgpjio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebaknrseua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebanking-ch3-ubs-a3ab0.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebanking-ch3-ubs-a3ab0.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebbwwmsivb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebduqypgcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebfzulhqzo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebijaopyeh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eblkwagzmn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebonynexus.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebosonzuwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebrou2a12.brouu2.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebruouryverify.ebrouinforma.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebtpntfllm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecaltatxpf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecatyytsio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eccoselect-outlook-auth-0ffice365.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eccoselect-outlook-auth-0ffice365.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eccoselect1-outlook-auth-0ffice365.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eccoselect1-outlook-auth-0ffice365.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eccvwticlifiagcfuters.sobre201.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecfmgcnafe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"echxteyvfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eciarjgojm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eclass.johnrobertpowers.co.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200004798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eclassrc.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eclfxduzrv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecommerecly.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"economic-poet-b50.notion.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200004802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecphtdnior.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecqtqbclsg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecslqvrysy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecstatic-yalow.212-192-246-28.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200004806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecu-info.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200004807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecumsjtmgk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecusutixpi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecvralwbdp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecvykmuxsq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecydztxaya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edacopaeqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edawagqlce.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edazeljtsv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edbnxsfptq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edbrooks.graphics"; content:"Host"; http_header; classtype:attempted-recon; sid:200004817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edbwphfdgv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eddbankofamerica5912.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eddhzhisqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edeydfexef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edfgpbehnp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edfujvnvje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edgecryptood.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edisonair-sharedfolder-0fficedocs.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edisonair-sharedfolder-0fficedocs.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"editingthatworks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edlldyfwzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edments.edments.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edmjfcngvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edmqpiscde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edmzmwjpda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edocuments18032022app-1310252903.cos.na-ashburn.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edpwuzretb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edrfqpoxjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edrvereeix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eduassignmentshelp.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200004837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"educaresatkhira.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edudovrmuv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edufarm.com.np"; content:"Host"; http_header; classtype:attempted-recon; sid:200004840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edzkvdaisq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eedaejrsac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eefmunraae.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eehinruxrc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eeiisvidsw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eeimnirdub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eejlxsycvp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eephvaualw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eeqjgbwtyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eetsumhafb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eeuyfwihmz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eewaaoavgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eexfjeiprc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eeyackajdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eezxqlaync.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efad-sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efanuhvflb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efax25042022-webapps1-1311433986.cos.ap-chengdu.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efcjzafyef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efcwwqdlja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efeccmneum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efedgrayyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"effism.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efgtavegdc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efikyfgeul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efrrqssjka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eft-0ert-6jhg-hert-g9fhw-rfhn-wehrnf-hjwn-efr4erf.obs.ap-southeast-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efvhaeabzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efygnuxrky.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efzgtrh-ddbck-baeec4.ingress-florina.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200004870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egejnvatol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egfvubmwen.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eglhtfqttm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egmropapwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egniol.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egnitekobh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egnllfqtyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egojvhkjef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egqidftzqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egqknpielq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egqzzurllh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egrewfvdsk-cvw0ore-jfg09wrjh-gf0jwed-fj0dfdf.obs.af-south-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egszvitoxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egtscsypst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egulmrwuoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egvldjcfxo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egvqxawzkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egwgbuvnzc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehclkbulff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehehnvfitc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehejtbzbvm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehgrceighr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehkbkazanm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehlpdyikbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehqileberj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehsiuskema.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehurzcxicz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehvbfskbis.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehw0.builder.hemsida24.se"; content:"Host"; http_header; classtype:attempted-recon; sid:200004899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehxdfqjbed.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehyqwncaoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehyrfculpd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eibjwsfuwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eidiyrcyaf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eifvffczrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eigamtjnou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eihcqdcqsl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eihzerpwsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eikdmrwjtk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eikdzudkud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eikinchdtb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eimugljpir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eiqanbavey.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eiqjhxcqqn.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200004914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eirokcjemw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eiutmcpbri.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eivpamvbug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eizhang.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejeebkynam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejgmjvimdb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejhtsjfjcw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejipqhoyzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejjjqvsxlv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejkzxzdlib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejlcfzlahh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejlhopqtyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejodsvgbuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejovypfybk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejpgzrxbye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejrlatbdux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejshelgfxt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejuwboxjvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejvyhdbhwz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ek1-nep.3utilities.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekbrhsilpa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekcjwlhubf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekcupfnlxv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekdibvejzo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekhaan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekhzjdkvel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eki-net.1miiei.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eki-net.com.steway.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200004942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekiohnners.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekjcinjvaf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekncmokcmw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekpjpdjkpq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekttvgkkyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elaboratetemptingpress.carmeloarop.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elcjqrhlht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elckrnzyhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eldbvvgrzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"electrocoolhvacr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elektroonline.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200004953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elfatnianass.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elfinanciero.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elimperiodeldesamparo.com.ar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elissaalvey.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elitedentalofsi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eliteskullsmilsimcwb.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200004959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elizabethhauler.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elladabkfh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ellington5106.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elmec4you.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200004963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elnrpcchfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elomo.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200004965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elrimuzaot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elsckfkeny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elsewedy-td.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elta-hellenic-post.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elta-hellenic-post.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eltexinc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elvgzqueyg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elzcfobokj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"email-businessionos.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200004974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"email302.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emailassistance-sfr.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emailsettings.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emailverificationupdate39.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emailverificationupdate82.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emailverificationupdate9.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emailwebaccess.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200004981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"embkhhyzor.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"embyfarmsltd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emcnifcwzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emconti.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emcwyqdehl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emdlbpxczj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emerson-vertiv-ups.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emetbuqavq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emgvqruybd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emhsrtzons.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eminengalicia.iniciositioweb.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emissionebp-card.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emissionebpcard.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emissionebprcard.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emissionecarta.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emissionepay.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emlink.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200004998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emmgdfenhg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emmjsjhbos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emmxertvou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emphasize.qhigh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"empty-paper-6486.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"empty-rice-4c1a.brian2495.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"empty-river-9729.qm4e2oon.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emtlstexzs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emunufgnvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emxpiaiexm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emzafbbodq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"en.kprfn.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"en.vivuni.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enabyrdayw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enbolivia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enchanted-efficient-cockatoo.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200005014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enchanting-pixie-f3b3c3.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"encoded.hanburykitchen.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"encodedgenomics.hardshipuniversity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"encryptaiu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"encryptbtck.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"encryptdrive.booogle.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"encrypthkpd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"encryptodapps.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"encurtador.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"energiebonus-sichern-sparka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"energiebonus-sparkasse.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"energoservice.ge"; content:"Host"; http_header; classtype:attempted-recon; sid:200005026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"energyshop-bitflyer.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enfin-a457d.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enfin-a457d.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enfrlbvkac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"engcamp.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"engidagraphics.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enjoyapartments.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enkcfrkoqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enlineasistenciadaviplat34.asistentedavi.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enmdcqetgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enmodofeliz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"entbqnk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"entbqnk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"entreprisedeplomberie.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enutvdcggq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enuywdsaff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enviousashamedcoldfusion.onlinebankinf.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enzmjdtfbm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eodvhljobz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eoffice.bulungan.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200005046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eogwdkwzjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eohnjoxurd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eoiksfzkyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eomikvhqos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eomuafrbel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eoqhlidkcw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eoqrgeoiqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eoslvyayvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eovvzjoenm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eowlxxkeve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ep-2hv.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epewdvdkqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epiaqmwuhp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epihdcwksf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epizyszsiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epjwttgelh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epllhtemve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epochfinancialus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epolkszpul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epoxqzauzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epozikmzih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epqjcyqtvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epqteeialy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epqzvlkqct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eptqoqfeze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epurndpzjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epwiqiumvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epwrnmfivv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epxpijajgh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqaekzyoyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqdtzuvozh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqjgppjnhi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqlghmlcoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqoisjmwcg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqpatcxesd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqrhlslslv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"equalivet.org.ph"; content:"Host"; http_header; classtype:attempted-recon; sid:200005083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"equalpleasantmonitor.aderlsk.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"equipotecnicosoportedeerror.gaaliciierar.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"equired.xr0e13.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqvcfzvnxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqximyyppm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqywmbthcv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqzrxyfwid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eramixpnab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eravnyolzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erc20-coin.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ercdkosylt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erconxzajb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eresnuestroganador.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eresnuestroganadorr.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ergambrummetre23.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200005098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ergusisialabie.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erhgaubdhc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erhvxovsod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erjhhntwtu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erl.com.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200005103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erlgh34klhklfg.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200005104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erpjqjujpg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erqmjseyms.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erqxnbyxjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"error.de.in.ingreso.nalumosovocationalinstitute.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"errxcghrza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ershamshad.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200005110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ervklzdcyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erwzeehidx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esbbzuynoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esbndsmjhk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"escolar.family"; content:"Host"; http_header; classtype:attempted-recon; sid:200005115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"escueladeatenas.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200005116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esd-dbs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eseowncsyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esfdesentakip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esfgsdhjggsdgsdg.sdfvsdgdgsdg.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esfuqxulig.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esig.co.kr"; content:"Host"; http_header; classtype:attempted-recon; sid:200005122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esnafbenim.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"espace-client-facture.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"espace-ma-vitale.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"espace-sfr.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"espacevitale-ameli.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"espacevitale-cpam.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esperanzabravo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esqinhhvno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esqwhslxfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esqyicoxve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"essdomijix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"essonjpjegfilamotepage.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"essonjpjegfilamotepage.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esszoqb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"estado-personas.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200005137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etac.co.jp-urasqun.armetaverse.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200005138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etatrecharge.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etc-mieisais.ptxhge.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etcajkcs.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etfadqzjxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etfzsywoin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etgqbecxgf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eth-1inch.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200005145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eth-bit.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200005146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eth-bit.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200005147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eth-mining016.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eth-pos.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200005149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eth-wintermute.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethbw.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethdw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethereum-16miningarea.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethereum-18miningarea.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethereum2pool.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200005155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethers-airdrops.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200005156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethersairdrops.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200005157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethhex.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethjq.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethjs.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethju.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethme.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethnictrendz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethnldfbgp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etloheszkl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etlte.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etnpclsynm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etnsgeplkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etqekhlnmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etsodlfxuk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etuyfjsfnu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etvdekoazh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etvdtvwtpe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etwildhwtk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eu-001.fra1.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eubpgdhyut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eufbjymnmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eugnerally-wixsite-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eugsejliet.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"euiapjvqxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-peaccoey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-peaczoey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-peaczzey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-peaecoey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-peascoey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-psacaesy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-puauaesy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-pzeuaesy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-roeaaesy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-roeavemw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-rtscey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-rtscsy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-rtscuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-rtsczy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-rzesansy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-rzeuaesy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-ssetey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-taseasvs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-toeaveaz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-toeavsuz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-tsecsza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-tsecszu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-tuuscsuz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eulxugspof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eumcyckapo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eupbucajqc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"euqmhzldxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eurdefi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eurobengal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eutbpmhsmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"euvjggfbjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"euzlhkgpwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ev3db3.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evbbagdsfw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evcxxbyatd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"event-domino.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200005218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"event-domino.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"event-staratlas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"event-staratlas.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eventchip2b.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eventkoindomino.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"everestmotors.com.np"; content:"Host"; http_header; classtype:attempted-recon; sid:200005224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evergreenaquaopengroup.pgyyoun.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"everyoilydrivers.hmtlsfsf.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evewlnblyg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eveylxrhew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evgqjrggzm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evhbiufvij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evkfsyrjzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evmbwnpgmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evolbithman.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evolutionsny.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-gb-tracking.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-gb-tracking.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-parcel-id284.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-parcel-id284.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-track-id10.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-track-id10.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-track-id92.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-track-id92.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-tracking-id192.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-tracking-id192.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-tracking-id34.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-tracking-id34.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-tracking-id384.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-tracking-id384.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-uk-package.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-uk-package.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evrkbjkkmn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evrxcrhsue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evvnpbewxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evwidcdbgi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evxigqaole.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evydrmdjie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evziwxutwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewa.epfl.ch.inverbd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewahfwzeky.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewdaeikczm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewdljcbvrs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewfzmlflxo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewjptkwcfh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewovstkldx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewplay.se"; content:"Host"; http_header; classtype:attempted-recon; sid:200005265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewqdsljorn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewrttewterwterwtewr.wwerewrerwetwe.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewvmlbxweo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewwfxagxfq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewxrjnuahu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewxyfhbxuw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewzkiuupdz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exacgmykaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"excelcashflowz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exch-093data0303.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exch-093data0303.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exchange24x7.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exchange4free.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"excited-foil-jujube.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200005279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exdqmbnmuw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exfejmvbcs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exgwrbuvrt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exito-validation.260mb.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exitoapptuya.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exitoasesoresalcliente.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exitopaytuya.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200005286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exitotuyapayfmw.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200005287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exitoytuya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exitsecutt.260mb.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exittopagosapp.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200005290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exkzkumzno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exodos-wallett.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exodus.com-wallets.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exodus.com.download-wallet.arcticasfalt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exodusweb-pro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exowapohxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exoxdsduds-walle.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"expediapartnercentral.solemarnoronha.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200005298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"explorenewcreativeterritory.my.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200005299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"expoglobal.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"expohogarcix.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"expressil-15323.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"expressil-15323.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"expressil-a749b.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"expressil-a749b.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exquisite-treacle-9155f5.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exrjiqdhbn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exscdrrpofb.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"extracloud.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200005309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exwjbdsrfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exygwifxwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exyiriuvot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eybaclaopz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eyebayzulm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eyebeyasvda.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eyeweb.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200005316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eyewebsolution.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200005317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eyhgtwpwjjysh.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eykmwvedgy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eyoxebprgs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eyuwptzoik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eyvxqintki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezbbbqkrck.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezblox.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200005324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezcm137.klaastemedia.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200005325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezfhuzemfb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezhtuhehcg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezhyuqphex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezjeanpctq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezonnuejhv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezrwveouys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezssausage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eztfoludoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezu-nft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezvsdkkasw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f2ax5-jqaaa-aaaad-qcutq-cai.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f2pools.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200005337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f7a00539b63b3b0283c25dfc949195cf.cfd"; content:"Host"; http_header; classtype:attempted-recon; sid:200005338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f7b8870cd2801tau.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200005339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f8put2prbcr1hfd.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f9w1lned0ruqblxi6jahwotak.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fa-tu-ra-luiza-y.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fabulous-toffee-c428f8.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-accts.pages-recovery.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-10014887759101.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-10014887759101.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-1001745724578101.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-1001745724578101.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-20024145785202.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-20024145785202.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-3003428746303.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-3003428746303.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-3030194675263030.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-3030194675263030.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-50054245178505.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-50054245178505.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-6006194358149606.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-6006194358149606.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-6006421785942606.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-6006421785942606.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-600645897241606.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-600645897241606.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-7007124360521707.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-70074128541707.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-70074128541707.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta1.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta120.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta125.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta126.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta134.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta14.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta160.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta171.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta20.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta248.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta252.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta266.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta268.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta270.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta287.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta288.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta296.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta301.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta310.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta311.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta320.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta34.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta340.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta346.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta347.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta348.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta349.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta35.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta352.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta353.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta355.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta358.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta359.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta360.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta361.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta362.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta363.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta364.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta365.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta366.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta367.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta369.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta370.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta371.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta372.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta373.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta374.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta375.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta376.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta378.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta379.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta380.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta381.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta382.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta383.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta385.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta386.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta387.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta388.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta389.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta391.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta392.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta393.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta394.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta395.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta396.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta397.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta398.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta399.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta40.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta400.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta401.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta402.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta403.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta57.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta60.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta64.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta72.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta76.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta77.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta82.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta89.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta96.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook.com.adxads.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200005449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook.somfivestar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook10002.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200005451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook10005.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200005452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook10008.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200005453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook10010.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200005454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookprivacycheck.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport1.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport100.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport21.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport22.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport23.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport24.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport25.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport26.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport27.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport31.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport32.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport33.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport34.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport35.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport36.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport37.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport38.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport39.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport40.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport41.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport42.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport43.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport44.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport45.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport46.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport47.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport48.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport49.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport50.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport51.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport52.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport53.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport54.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport55.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport56.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport57.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport59.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport60.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport61.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport62.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport63.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport65.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport67.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport68.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport69.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport70.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport71.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport72.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport75.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport76.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport78.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport79.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport81.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport82.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport83.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport84.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport85.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport86.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport87.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport88.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport89.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport90.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport91.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport92.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport94.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport95.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport96.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport98.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport99.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookverifikasi74.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facema.edu.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200005526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facenboollogin.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facetime-com.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facjxzemia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"factgrading.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fafugoiftb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faihownhiu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"failip420.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faioomfmrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faithfamilyintl.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faizankhan0408.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200005536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fajafvpjmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"falconinternational.com.np"; content:"Host"; http_header; classtype:attempted-recon; sid:200005538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faleballe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"falling-brook-b2a0.althaf30.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"falling-disk.1zofvddx.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fallmouth.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"falvk54lkhvfl.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200005543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"famjevhxbo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"famsuzsaln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fancy-rain-22bf.vakagew948.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fancy.bibirgadangdicipok.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fancyexpeditions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faqesslncf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"farnsbeuyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faroltiweb.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200005551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"farultlncb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faruq.boxmode.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200005553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fasbrmbfmr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fasessfotu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fashionrc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fast.for-orders.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastdapss.wiki"; content:"Host"; http_header; classtype:attempted-recon; sid:200005558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastrectifier.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fatura.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200005560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fauci.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faundkow.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200005562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"favedgyyxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fax-doc25042022webfax-1311433986.cos.ap-nanjing.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fax07032022doc1-1310019602.cos.na-siliconvalley.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fax07042022fax498apps58-1310726006.cos.ap-seoul.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fazfuyskpm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fazkeokhrr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-appeal-review-12768921.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-appeal-review-12768921.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-case-id-28031803-fcdc-48af.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-community-standards-344255.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-community-standards-344255.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-help-restrictioncase-f7ee1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-help-restrictioncase-f7ee1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-page-appealform-1357926.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-page-appealform-19287692.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-page-appealform-19287692.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-pages.proteksion-help.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb7927.bget.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200005580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbcqrigdsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbdwbmsmxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbflbsreyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbhcilycor.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbjojodjut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbkbboayen.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbnjkaxuiq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbnzocqnbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbookhelpsupport.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbookhelpsupport.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbskxidwas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbtylqtith.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbxhzyzkfw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fcbzaxrmhq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fccfc.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fcdsxfkmrt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fcferbzeco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fcmsoyfzwd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fcobcshkla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fcrprogetti.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fcvkstafjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fcwdhnogpb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fcwjuxryei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fcyyzuueru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fd.b8jgj0s.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdbkhnjtjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdcdcdrncq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdekmbfwyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdfcspgcdz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdg56.onlinebg0.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdiyzdtgwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdn.38961.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdpcgcgqhr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdqffohfji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdrwfpgavu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdscs.aldtqy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdscx.zb4i4i.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdzvwdhwev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"feaecmqruy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fearfulnicemultiprocessing.account21o.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"featjhbokh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"feayqozwcx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"federales.validacionoficial.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fednmhcrbg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"feelbons.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fefjehug.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fefrhf-s-school.thinkific.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fefwkoaced.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fefypekafj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fegfiqzrwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"feldmangaleweber.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"felicids.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200005632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"felixth.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"femaagfizj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"femzxqavka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fepigvkdty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fererre.kabelis.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200005637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fevjasqhnl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"feytviweft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ffcnunpvcu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ffcxfphcco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ffeiisfuwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ffiwdobobm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ffiyjsavsn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ffmnocjdje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ffmugbrmcs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ffqwmneabf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ffrancess-onlinne.pmotoo.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ffysmuojox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fg11c9p6n2q8osd1r689mntiavqib1ul567f545j245rkavf4mi1848.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fg1d45dcnij9l4g0s12ljp38iupli0189j72nut008njfqrl1j55m90.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgajbpzwom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgajnreumf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgaqrhphkc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgaveaxlop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgcdmgpchv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgdsxc.miles087.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgenm-6qaaa-aaaad-qcurq-cai.ic.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fghdskjhgjhkljg.ihostfull.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fghjr74rhudfguhtfguji.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgkqldspzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fglomphntf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fglztvzjdb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgnngffhdgd43.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgopfpxkys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgoypsnfgr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgpfgxgaka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgpuyzkyaw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgqbwpafzg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgqjsixsne.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgrpwvnqgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgtibntazm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgtlhpazsx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgtnwyjlql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fguvjeklvh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhdgdhfhj.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhduf.pfucali.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhfgj.lxxrmyy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhfhtvxbsw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhfysdlokk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhg.79176.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhgytscvbnv-htytredwvsxalokm.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhibwtzvqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhjlbcvsep.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhooqygjkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhplstknqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhtdpqydav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhvyulysfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhxmmoqeqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhydhjwith.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhyfbjqhdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fi-neearwallet.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fibffskqvg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fibpjzxgsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fidelitybank-ng.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200005695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fids.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200005696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fiejjzzlxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fieldoil-aad77.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fightagainstcriminal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fighting40s.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fihuytdzos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fiiqqglvmn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fikecihmti.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fiknixmrvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"filderhiper.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-annual-project.cesfulenter.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-cloud-download.remit-advance.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-connect-shared.loading-chats.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-login-micro-drive-doc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-login-micro-drive-doc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-pdf-cloud.voicee-pre.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-project-shared.init-datings.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-share-device-storage.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-share-drive-folder.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-share-drive-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-share-login-folder-doc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-share-login-folder-doc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-share-login-folder-local.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-share-login-folder-local.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-share-secu-doc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-share-secu-doc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-shared-cloud.lepoyanecalt.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-shared-clouds.data-shared.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file0z.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"files-secure-folder.ansimapreg.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"files.recloud-shared.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"filex.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"filex001.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fileyellowelite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"filiale-15-mps-152.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"filiale01-mps013.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"filiale05-177-mps.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200005732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"filiale13-mps12.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"filiale9-mps-189.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"film.jaheshguilan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"financeguidelaunchpad.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"financialaggravatingoutput.yoursegcity9875.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"finassetstrades.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"findhelpni.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"findlak-investing.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200005740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"findomestic01-filiale12.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"finfutureonliup.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"finfutureonliup.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"finleylrzc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"finoxfinance.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"finulasante.lasanteactive.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fiqgwhozjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fir-8da4d.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fir-8da4d.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fir41109.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fir41109.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fire.martobang.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"firebrickshorttermcells.pygcom.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"firenaci0n4llogc.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"firstalert.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200005755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"firstsourcesbus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"firwfdzhtj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fisgjxyrol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitzherbert.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fivelife.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200005760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fiverrespana.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fivkosxxnm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fiwrosruas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fiwtjjpuye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fixi.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200005765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjbbyodxzg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjbvjeijrr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjbzlmokvq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjfgfieugr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjhkjkuli.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjhpjqbpmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjjfjdf.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200005772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjpbfhzrpx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjqfgfacgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjqgwaftzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjrlkxtsot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkbqnvwhcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkbugexqsn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkcwipxduc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkdqyrkcgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkhcbcocpj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkioiseowl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkldolqjfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkliywtazi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fklnestcju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fknouknnud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fknqswfnue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkrfpcxfnt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkwmgcxvxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkwxjxptdd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkxnprbqzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkypjblkhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkyzwemvoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkzsgdvawa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flat-9be3.marpuasabentar.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flavianovis.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200005796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flbhwlbern.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flcancer39-px.rtrk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flddzeekiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flfluupfun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fliesheres.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fljasvflns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"floral-glade-f27c.do050.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"floranostra.hu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"florejackie.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200005805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"floridaaluminumsystems.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"floweryuniqueflashdrives.diosestodo14.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flowserve-us.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flthkmbwox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flufmqxdrv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fluksrv.mycpanel.rs"; content:"Host"; http_header; classtype:attempted-recon; sid:200005811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fluttergirl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flwckbxwlc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flwznmxien.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flyairprestige.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flyvfrontier.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flziphcpap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmawwtirax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmfgubvnet.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmiipvdbxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmnfvmesrv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmosyppbjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmp.wordpressmlm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmqsukjqoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmrefyfuls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmuxbjzrhf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmvppqszly.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmwszwgnxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmyljbvhzq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmyobaavig.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmztydbsus.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fnabxlzypg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fndwltpvkj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fnjhjqkddu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fnksnfaycu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fnlbyoykso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fnogfjsmdz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fnvlrcsdet.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fnysmup.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"foapuppsnb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"focunffsny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"focxcdohmg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fohfeouvlb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fohssbxigc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fohtgquncv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"foiotgfjpk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fojrpkmped.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fojudnqajn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"folder-documet-files.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200005849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"folder-preview-project.privatee-inv.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"folder-private-pdf.auth-gear.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"folder-private-project.important-chat.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"folder-shared-file.voice-chatt.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"folder.verify-files.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fomaxsenxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fongpihlzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"foodcarry.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200005857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"foofeqxluc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"foppgbatfh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"foratech.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200005860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"forest-boa-1169.typedream.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"forexabc.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"forextradingtruth.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"form.submit.q73s.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200005864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"form.submit.r27b.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200005865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"formbuddy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"formez-vous.eligibilite-web.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"forms.formium.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200005868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"forms.sendpulse.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"formtools.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fornewsgroup.run.place"; content:"Host"; http_header; classtype:attempted-recon; sid:200005871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fortandpgssprts432.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fortul.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fortunate.waiguohuo.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fortus.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200005875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"forums.pancakesvqp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fosterfulllegh.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fotvhvgdeh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"foucafjmeu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"foudanlir.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200005880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"foulauth-2logosyx.mom"; content:"Host"; http_header; classtype:attempted-recon; sid:200005881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"foundationpool.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fouridmaniensem569.page.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200005883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"foxywanda.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpbglogovr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpbleitidh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpbpmsflbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpcxvwznjb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fphjccyhhi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpidqmrjua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpjziacoda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpkwqnjmnm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpkzxdytvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpnxxsxydw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpsobtkaqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpumsflcbs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpxgapfwuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpxgegencq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpxrjrjqzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpywiepcxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpzrjdheqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqaxmmwtiz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqayponwpe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqctlypvll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqcxfasjdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqdwlomcoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqhihopwpm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqhixnygip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqigjdxvda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqmcelhzmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqntvqkfbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqnxcvrjga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqoolrbldp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqrdpfrvzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqrjhaxhrn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqujqxykyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqvrbchifl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqziatvqtd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fr-europe564598-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fr443.liv2454.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fragrant-dew-337b.orgetjot183.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fragrant-grass-5770.scrtygdjahg.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fragrantghgh.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"francees-net.ssui.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frances-home.cosmeticlab.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frankedu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frankfurtertsparkasse.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frasercityindustries.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200005928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frbribqrmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frcyjtondn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frecwqdnwy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freeclicknowsandshare.work.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200005932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freedompatchcomla.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freedrop.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200005934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freeliker.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freeprocrack.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freesolana.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freesolanamining.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freetopdomino.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freg-nine.pt"; content:"Host"; http_header; classtype:attempted-recon; sid:200005940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freim-regulation.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200005941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frenchpropergraduate.alfonso6275.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frfftnxpeg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frfxqffbed.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"friendsofnechockey.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"friesssd0001.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"friesssd0001.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"friesssd00010.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"friesssd00010.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"friesssd0002.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"friesssd0003.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"friesssd0004.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"friesssd0005.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"friesssd0006.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"friesssd0006.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"friesssd0008.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"friesssd0009.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"friesssd0009.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frlxqmhmwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frnnrlwdec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frogout.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fromcollegetocorporate.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200005962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fronti-106921.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frontier-airlinesreservations.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frosty-credit-9294.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frosty-satoshi.45-88-108-231.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200005966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frsjfjuexh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frsjkbvadsayt.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frvkznjrby.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frvwmhlkks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fsbwtlumpz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fschwuftxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fsgoydmkbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fsgtlmlyee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fshjzqdicw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fsjuqrmjyk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fskocbjtov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fslyjdlzki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fsvllc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fszdvcwglu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftaktus.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200005981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftbiwknoiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftgmpyqfdz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fti.unmerpas.ac.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200005984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftiotsrdqd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftkcyjbjao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftlvsjxzmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftmgbmaqoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftncvsintt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftp.cnc.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200005990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftqzjaiztf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftsrgvibtr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftszllaibb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftwgsxdinb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx-ca.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx-pro-register.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200005996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx-register-pro.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200005997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx-register.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx-register.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200005999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200006000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx.work"; content:"Host"; http_header; classtype:attempted-recon; sid:200006001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx012.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx6.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200006003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx666888123ftxapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftxbonus.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200006005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftxcprotocol.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftxff.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftxgb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftxghayydq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftzmjttnvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fufaxh84js39fj2.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fufkvzqmpb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fufsjcvrod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fukaplftkn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"full.mailboxs.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fullpromo.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200006016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fumanecdcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fundacionelarcadenoe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fundacionmontesinai.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200006019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"funiswap.exchange"; content:"Host"; http_header; classtype:attempted-recon; sid:200006020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fupddlnxok.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"furryvengeancefve1.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"futec.futminna.edu.ng"; content:"Host"; http_header; classtype:attempted-recon; sid:200006023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"futurama-ex.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fuxtwadzam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fuzhqisipf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fuzlekogec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fuzvwbmree.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvdiwqmjmw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvdjgzclxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvemzpoeuo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvlcigztbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvnjkxfaor.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvnzbozovm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvoikttecw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvoirrgoin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvolyrvfbb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvoplgujxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvslwqvnuy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvwxavqpyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwcvvqcegd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwgvotxbez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwgzcuqeoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwjzdqnhat.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwkkxfnpxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwkvbnyouy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwkyatrhak.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwsgyndddq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwwbwbuory.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwwhqehdpi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwzldvqrgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwzlunlqnu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fx164fax08022022fax-1310019602.cos.eu-frankfurt.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fx22082022fxx9830fx08-1312962597.cos.ap-nanjing.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fx406543docs4580246-1309906520.cos.eu-frankfurt.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fx8822fax768fx7webs-1312962597.cos.ap-chongqing.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxbkyhgpmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxcvzcrzzu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxhalifax.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxjpvxzobd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxkeipjdza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxkiufubit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxnyepbkwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxybalktzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxzblpybxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fydcqvuetr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyhogyzvnz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyhsxoelqo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyhumavjzc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyihhgtrqy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyipajmmca.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyjsvz.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyndiqaq.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200006074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyowofdgqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyqvdluamu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyttgtytrt.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyufnolkwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyvgnrduje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyvgwe.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200006080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fywqeyczcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyxceyoofd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyzvziqhmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzbocfcpre.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzeadalwkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzgniiybxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzhfqgdgds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzjirpixsl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fznwddbjst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzqzwpszik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzsfblimcz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fztanzcgai.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzuoliogzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzvmskikiz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzvnbbezbd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzvyneamuk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"g-e009911.exitopersonas.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"g-mtcc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"g348g0fh4-03whfg-0hwe-fcjn-w80hr4-08fghw8-efh.obs.af-south-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"g6beb-cqaaa-aaaad-qd2ma-cai.raw.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"g7ynr2h5hijwv4sxkszjzd7ra6abxqsntppxuzoefnkaojo5laca.arweave.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gaelectric.ibuyusedasics.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gaerjqtmgj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gafhwypniq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gafonline.mil.gh"; content:"Host"; http_header; classtype:attempted-recon; sid:200006105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gahguvmzwo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gaitnonmhr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gal46463836384.merchelugal.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"galerieharmonia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"galibubblycraftydriversdfegalicia.is2i1.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"galiciaenlinea-1.larescomco.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"galiciaonlinebarkning.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"galiciapersonal00993.tomasnuve11.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"galiciasuupporrtseguridad.galiciaaaa.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"galiciquebe.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"galiclabanckingonlinhb.activiodaviv.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gallant-wright.185-206-144-67.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200006117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"galumbok-arssumh.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"game-defiknidgoms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"game.hicage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gaming-experience.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200006121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ganhbnseyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ganjnkpglv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ganmvtenzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ganvugpvle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gapabboynd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gaqocdqiut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"garaperkitotik.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200006128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"garenaquafree.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"garmon.com.ar"; content:"Host"; http_header; classtype:attempted-recon; sid:200006130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"garpwleqgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gasjoqtudy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gasoktnhhf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gatlinburg-cabins-now.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gatvyfzpxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gaudfpgtrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gausnow.uno"; content:"Host"; http_header; classtype:attempted-recon; sid:200006137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gavbnjnvsj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gayrpqmeop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gb-evri-package.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gb-evri-package.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbacgtsscy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gben.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200006143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbfymyaotx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbhdhrozzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbldqqiwcw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbnybqxijh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbonplqgjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbqfxlzamn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbqlgzittz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbrpwlsrom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbrusgaxiu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbsqkmocpi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbwellnessspa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbwkkudexx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbyezqjuqc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gc.elin.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200006157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcdeqjdsxe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcdkvoqoat.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gckbirqynm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcotykbfji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcourdefraind.mom"; content:"Host"; http_header; classtype:attempted-recon; sid:200006162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcroauthmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcxmmtwxnb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcybrzcgiu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gczcpdsvcc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdelements.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdfwvvgbff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdgotymiiz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdgrxfkjch.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdmcvtbvhh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdqqfncyes.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdqvebnbte.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdrh.hjszyy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdrhkazabi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdtvksmwbo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdudqxdwlf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdusfbkfoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdxhxubblk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdyplqhnft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geaoodyrrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gebfbgvmvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geekd.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200006183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gefcryedet.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gefdilxxmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geftdeyzmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gemini-00e.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geminimobimovel.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gemkcxdyps.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gene.d3blxfshqg4512.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"genehmigencorner.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"general.general-auth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"general0493043.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"general0493043.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"generalaa-e69f4.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"generalaa-e69f4.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"generateethereum.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"genie-alba.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geniusinu.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"genoeggs.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200006200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gentl.bibirkumaumeletus.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gepogcxnoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geqbymjrxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geqytnjpdr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gerenciador-caixa-gov-login-th1.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gergesirtl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gerlanguages-serverde.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200006207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gescova.cat"; content:"Host"; http_header; classtype:attempted-recon; sid:200006208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gessoriodejaneiro.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200006209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gestion-ameli-fr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gestionarcitadaviviendaenlinea.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gestionsigwebchile.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gestiscicarte.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"get.freetopdomino.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"getapps.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200006215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"getartd.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"getfremlbb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"getlikesfree.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"getmyg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"getmyjio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geulsztdtw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geuntacqhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gevmara.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gevphfusdh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gewwwvjjvv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gezwurokmi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gezzrczmlw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfaxtpuanf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfazsosiji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfcvn.bjckam.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfcyogxdhj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdhb.etykbzg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfenjdbqcj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfjdgfgty.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfjwzmkoql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gflkvrgqum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfscaetnzr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfspimgvei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfthc.surveysparrow.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfvabnqtos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfvnjofpsy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfvqewjdtl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfxsehghkc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfymhsuqtx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfyuwkxhsg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfzcqxblwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfzskctxfx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ggclolvzwg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ggdbhimywg.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ggdbhimywg.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ggdfdfd.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200006251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ggffftfhhfft.byethost5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gggrtzbxyk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gghjj.edvjayw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gglflfgvxt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gglvpdymip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ggpakqungi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ggukkopadm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ggyceljtna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghadtiklyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghbecmgllj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghbkvmrxka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghbqpsoxxo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghcptsfqdk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfaqgdvbo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfdc.x9130w7.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfdcv.owydwj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfn.gaxrmyy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghggmhlgpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghjtasgkhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghkishmzgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghl9uc.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghorana.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghpdugbyyn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghqsmcfugi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghrjj.bcy0vsl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghsbafhdtf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghtyaischl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghxgvnheyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghzxyxlxfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"giflstdilscowr.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200006281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"giflztdilscowf.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"giflztdilscowh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gifofnqihm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gifted-euclid.185-101-35-170.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200006285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"giftgarden.ae"; content:"Host"; http_header; classtype:attempted-recon; sid:200006286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gigvpqiupa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"giirnmmpjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gijgpary.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gikkvugbyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gilroypresents.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200006291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ginsikzsvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"giovadadzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"girkhgicox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"girls-tube.mobi"; content:"Host"; http_header; classtype:attempted-recon; sid:200006295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gisclxunil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gitep.com.ar"; content:"Host"; http_header; classtype:attempted-recon; sid:200006297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"giwpqzuvup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gixdxffehr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gixlrdedns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gixvfoncrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"giyzejlftg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gizfcrmotu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjbnvxgval.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjcnbxeyaxlrmycpwke-lzjgljgjmqapmtlgvnl-d-kqfyinxpoenwiouwal.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200006305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjeycfantx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjjqvncjxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjkgmrhvml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjksudohep.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjljikqerr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjnrcpmfrm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjoycrbzgd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjozfebafp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjryijpuny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjuvlzjchy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjwoclmbsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjxcbagkof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjyasprlvq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjylcwfpya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkbcijdebp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkbdwaakyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkfsjbooqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkiadlbdkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gklytdpzwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkmckvoipi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkndqjhace.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkqpmjulhe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkrcqcbahx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkrghoofpu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkrxtqrioc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gktpaagcgd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkydvbnqwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladysjohnny.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glamorouscrookedsquares.galicia092.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glbftxtgvi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glbohevsds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glbxvyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glcpaukrwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gldcmedjfg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glendaleazbeecontrol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glennrothenberg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glfnuagfwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gljaptfdjn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gljprnzhpf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gllgqqzsar.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gllraauvmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gloaezfoso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"globalmediahq.ultimatemusclegrowth.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"globalpostosbnn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"globovidrosss.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glogo.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gloomyunfinisheddivisor.juanperez109.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gloriadesempreserfeliz.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200006353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glsword.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gltkiufwfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glxedfhqos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmbxwlpfsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmephimvxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmfbxkfjio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmfikoqodh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmgbtxbpth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmgroupllc.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmjzkhpyjv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmkenoysgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmkfsdinxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmkvlcobjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmlljascvq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmo-aozera.banka-co-jp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmo-aozera.bankn-japan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmo-aozere.bankn-japan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmo-back.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmo-back.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200006372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmo-bask.co.jp.xrjdj.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmsocrates.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200006374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmstudio.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmtbzwztlq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmtckzxlog.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmx-account-activation0.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmx-deutschland-gmbh4.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmxlitt.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmycmnkfgd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmycmviiss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmzszfhgcj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gn415v.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnbecrckng.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnckjyfroh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnflmeccbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnosis-sefe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gntntxhagn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnugrujqpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnvukbdvlx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnyddvpmik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnyrlcrjaw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"go.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200006394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"go.milliontech.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"go24link.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goafpclfbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gobjarimua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gobwlccdwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"godocusign-login.rackapp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goelxujhew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goewssyijy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gohbvwsiil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goiopwyaoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gojer.z13.web.core.windows.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gokfqatkha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gold.zoomcolle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goldengold.mom"; content:"Host"; http_header; classtype:attempted-recon; sid:200006408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goldstanderfunny-bab249.ingress-erytho.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200006409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"golleads.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gomasaczrao.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gomaseczrao.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gomaseczreo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gomesaczrao.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gonzaleztransformacion.com.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200006415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"good12345.tripod.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goods-vinted.4652254.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"google.schreinerei-wohlfart.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200006418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goomvdlysa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goonline-biznes.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200006420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goonline-blznes.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200006421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goonline-blznes.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200006422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goonline.cookingrosta.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gooopfadof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goprxeplht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goritrest.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goshenadeautos.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200006427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gotbglcvbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"govedu-auth-0ffice365-folder.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"govedu-auth-0ffice365-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"govqpzalxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gozyrwwnvr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpasqmzkpc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpbpztmzht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpcarautocenter-web-sand-home.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpflltsojg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpgmljtbee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpgycpzmfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpiqdyqdja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpjldpdvuo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpkirbbfjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpkkvfygdp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gplavrhmfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpofwcomfk5.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpqkliwtyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpsnrdeyth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpulcjpyoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpusuldgcc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpwxlwaiol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpxcwayxqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqakpgqzjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqcxnlydvj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqdwpdumlg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqhpjksktb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqjpyklkar.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqkrxisftb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqkwcmjtch.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqouuicjqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqpejlstxf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqpfpnpbiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqrmkbudbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqrvqrknfp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqsjsfbiuk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqtluuaouj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gquhpsxeoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqupxmeobh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqutfmrjfm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gquvhvhojj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"graceful-pushy-thing.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200006469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gracioussupermall.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gradfbtbit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"graphic-boulder-301015.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grceywnluy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grcslnbqeu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"greadedu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"green--dream--6331-on-fleek-co.translate.goog"; content:"Host"; http_header; classtype:attempted-recon; sid:200006476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"green-pine-7fe7.do020.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"green-surf-5642.5pi4f9jl.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"greenland.co.mz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"greenlifeconcierge.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"greenvonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"greenwayweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grem-6yt7h.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grem-6yt7h.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grfe.723k3s.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grfogzpujd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grgxjlslkf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grhaxflrwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gripxnagei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grivylndbm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grknxplylt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grlkllljdw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grorcjpjts.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"groupesuseg.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200006494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grouptravellady.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grove-5bd0a.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grove-5bd0a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grst.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grtoykmfgj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gruop18.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200006500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupo-b4nc0lombia.home1749.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupo.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200006502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupodetrabajo.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200006503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupoelectorial.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200006504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupoexitopaya.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200006505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupoonix.cong.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200006506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupoosinez.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200006507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gruposanisidro.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200006508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gruppobperbanca.etringallery.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gruppobperbanca.purnnikajyotish.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gruppobperbanca.sefar-news.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grxgplcpjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gsfxmekbjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gsjnvnznld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gskvfbdtxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gsobazlvze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gsorcmctya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gsqjgjclbx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gstgtseqdc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gsulgbqzie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gsvmyyemjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gszvtpfeqy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtavkitfxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtbklcrlaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtdnhuavqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gteemuezox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtessentails.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200006527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtgimrlmnk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtgustline.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtiabwjarw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtigrovvs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtixnfxudi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtlvmwuvgk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtmhpknxan.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtquzybxbo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtterkhyxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gttrcrexsg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gttrhytgtyh.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtuwfldwxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtvysngsol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtwcgttwuo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtxtltfxhc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtyaner.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtyudrszlc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guasxgpqtw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guepparting.mom"; content:"Host"; http_header; classtype:attempted-recon; sid:200006546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guftoirora.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guidesrv-infode.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200006548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guli.onlinebg0.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guowpjubcj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guphwpgylf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gupisgxzbm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guprosselecto.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200006553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guqgcxutjn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gurukanth.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gusyofihsq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guttercatgang.free-drop.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200006557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guvhkvzncu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guvsxabvrc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guxnumsvne.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guytghoeru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gv30e4r9gf-j3wr4-gfvn-wernjvfc-enr-ngv-e9rnj-vrv.obs.ap-southeast-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvatrgsguy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvavnheqyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvblrczjuv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvbwrpbvjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvhepfrgcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvhoeurpfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvnmtnradq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvqdwrfgpr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvuaghtcxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvuyguhhqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvvrmvslex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvxsdavint.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvzmsfwxhq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwcxsqftjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwddouxmuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwen00000005.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwen00000005.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwen00000006.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwen00000006.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwen00000007.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwen00000007.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwen00000009.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwfaxpnjjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwicslnmdn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwijipoekb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwjysotzwt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwkaimtvsc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwklynazer.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwocnzmmlp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwoxlxhihr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwpcouzzvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwpzbavidg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwqnknvssj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwqvkmazjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwubskcnmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwzwrdkuqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxa1ij.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxaedzkwal.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxhrdbikqc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxiahmuwuh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxjjejqwjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxmzvptjem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxorqrcyko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxsaaolwjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxukvfgtzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxuotkvwaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxzpajhrpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxzvppeyny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gyibnjxbyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gykhhmnvjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gykjnhpkgu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gymafsfsfp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gynocyzpbb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gyoocdsfyt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gypsysoulatelier.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gysfmzvdqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gywlolxnic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gyyewocfmn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gyzccsnwgj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzcmikdcwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzdoihugbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzdrgfsnkw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzemiwqjmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzhlqkikof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzkgwwleqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzknnvwemt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzkquffapk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzlagkdbfz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzlqocdsok.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzmzqjupwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gznkbzluug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gznxksdltv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzqbrgtaad.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzrkafcelb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzscyqlvmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzsjmdfnzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzveuhmurr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzwmqevfdw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzxsipvsgh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzywhadnjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzzwnhaguq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.b2bxjea.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.coinbaive.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.croknqp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.fxzqpgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gefun18732.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gefun37352.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gefun58122.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gefun68299.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gefun79595.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gefun93676.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gobsaym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.hiflyk28075.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.jhafrwo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.jkozclh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.kgoumav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.mhevtwo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.miaycel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.tmaeqcr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.zxgiqvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h9is92.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"habbocreditosparati.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"habi10100200.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"habszbkpos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"habvfyjsjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hacedordeaventuras.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hacgphktky.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hacof.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hadeedethopia.nyatechservices.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hadletzsvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hadsvszhdu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hagbsaxuhm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hahdaeupdate.es.tl"; content:"Host"; http_header; classtype:attempted-recon; sid:200006675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"halibotton.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200006676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hall-arch.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"haloujie.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"handakai.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"handvina.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hangovertest1.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"happydazecostumes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"happyvalleyvapes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hardxjyesz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"harochngpw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"haroldhazard1-wixsite-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"harqegtppq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hatencioncliente.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hatocorozal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"havcuitnjb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"havnlwsnpi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hbajgeoexq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hbdmxlaxci.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hbdnjmitrj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hbexuiibbd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hbiwlrjkkd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hbkqhfucso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcefhnxyqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcfzwxlenl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcgodkrqqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcnwdxerby.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcplbsmotd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hctedmsvta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hctlbagomf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcufksllxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcwyduzueg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcykjfqqvm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcykvwfhvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcyrwozlin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdbbgqvasw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdeqjqgubh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdghedfd.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdinfxttzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdmfwxadfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdojbedyqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdqjbdyiqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdrpqiwxpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdvidbhiru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdwqzawoqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdxiiqcvwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthatlums.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heartfeltpitifulprofiles.verificsecurit.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heartworktattoofestival.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hebkruksgi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hechoparati.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200006725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hechosoloparati.byethost3.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hedefpanel.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hegjmebohp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hegyakqneh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heinthu1.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hejsxjapmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hellenic-post-elta.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hellenic-post-elta.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hellenic-post.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hellenic-post.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"help-vystarcu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"help.insecur.saftyalert.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"help.validation-page.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helpcase.28347213876.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helpcase.service10545216541.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helpcaseid.128793234256.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helpdeskserv1.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helpdeskserv21.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helpdeskserv25.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helpdeskzimbra.cliven.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200006745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helpmettaa.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helpmettaa.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helpmettacase1000.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helpmettacase1000.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helppadrestricteed.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helppadrestricteed.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helpsecure5687485198.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hemvvzpcqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hendaklahengkau.martulangsore.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heognqclud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heqiuvtpel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hercarresf.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hertzclubdk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hervochapiteaux.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hesdrzztka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heuagkbgcy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hf8u99.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfbanjlaud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfcuibcqml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfcxd.bzequa.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfcxnnlqjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcv.prnncdu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcv.todqyd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcx.h1h9f03.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdsfagfgss.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdtgsdfzhdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdvc.yj6p41y.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfepgxcirc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hffyububvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgcv.nlidsz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdc.djiguyk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdcv.xxl1exy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdv.mvjarhs.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfjvzznbcz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfmiehrpxz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfmquhtadl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfnhiyoqyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfqjmefvwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfrxlokswf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hftqpyptqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hg5566dh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hg5566gx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgcyikwacl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgdkwwzvej.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgfhdfdh.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgfhdfdhss.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hggqnsydhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hghasean.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hghtfbvspg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgiyurk.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200006795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgjnoualjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hglpxkvkut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgukrmgizf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hguoacbejq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgxbydnd.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgyjkoxnwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hh7n2-5yaaa-aaaad-qdrza-cai.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhfggtghxz.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhfgohrycn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhflgmfswy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhhybgcsce.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhjkk.txydihu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhjlkbuyum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhkanexzxf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhmwdupluz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhtzumeydk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhuhtroywb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhyvnumwsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiaxksehjk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiazwyqiqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hibxnyqomu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hidelsxziy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hidrdxrsfc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly10365.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly21173.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly27702.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly62556.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly85295.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly96975.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiflyk47344.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiflyk66656.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiklqcwfgp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hillwig-goodrow.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"himalayansherpa.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200006829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"himbauane.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hingehealths.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hipbaqmecu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiper2m.taplink.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200006833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hipzzigxef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiqdjbqbgj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiscsilidp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hisoftsxwnf.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hissfmablw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitman71hd-wixsite-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiwqnrhamd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hizuvotcnz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjcyxaorvl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjdgfgdh.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200006843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgcv.vxrxqz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjgsgjsfhsut.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjhadveurx231.dynssl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjhwxkgycl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjjpsyucpd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjkajokane.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjlpuvgqfc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjncvgviaw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjnezmjtxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjnztiybdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjrftzfkhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkagmyjmgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkdoehbmxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkdshtkrgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkexfimdfb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkfvcaeoro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hklbxnaprx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkmnqctrze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hknvkqavyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkotbvnmfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkpqtrxldi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkqtwxgcvf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkqyegrqqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkrlmryajw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkrxiscpvg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hksjwytsgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hksraktvjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkvfluyqqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkwxfmikbn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkxmqzhuqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkxygmpjhf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkyslixhgp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlcdukrbls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hldeeqfwqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hleapnugob.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlguxuzsqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlhzzgqhlt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlmpdegggd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlpgbphnhr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlqmquvyai.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlqxfxjmpd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlvrwzzwwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlvzcdhtfs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlwnaoppmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlxcwnsbob.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hm.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200006889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmahio.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200006890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmayqdojxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmclixvoqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmhgolmtqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmncsojrkf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmnwkcdeir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmpxelzriu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmrgaqphji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmxwtmhvnm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmzblxzgqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnbaypbhvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnftwumcfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hngq2b.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnhexnrkwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnjlkqiwmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnlxexiarl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnnhaxebwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnpgiawikn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnrutnnlrt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnstoepnnw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnvcodmdxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnxlatdfvp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnxuqhyjfb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnyureaftq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnzeexjrcb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoaqnvzczy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hodseqverd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hogdakzwzr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hohgwiywft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoje-temos-solucoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hokshasotre.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hokxdqvxcj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"holding-energy.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200006922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"holy-brook-fe7c.set1s511135.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"holy-disk-fe09.valeracooper00.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"holy-pine-586f.mariosa5862.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"holy-wind-f028.vgreengolf8866.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"home-5009984072.app-ionos.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"home-nft-magiceden.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"home.ojwqdo.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"home.revenue.services.aing1.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200006930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"homeacesspoocoini.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200006931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"homebamking.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"homebankarge.homebankarge.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"homebroublog.homelinking.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"homegalicia000.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"homeitau-seguridad.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"homenbanking45.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"homeofloveclt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"homijqvkcn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"honduasessor.ayuhonduor.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hongpham.com.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"honosglobalcorp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"honostkwik.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"honounced.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoouawvikk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hopxgroup.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoqhbljkjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hospicesource-0utlook-auth-0ffice5.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hospicesource-0utlook-auth-0ffice5.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hostingepagamento.viewdns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hostings.kilinkis.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200006951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hostnix.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hotel-booking-agoda.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hotel-pontos.gr"; content:"Host"; http_header; classtype:attempted-recon; sid:200006954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoteligeafiuggi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hotelpanamerican.com.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200006956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hotelxcaretrivieramaya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hotlimpinggreenware.cj67.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hotn-immutable.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hotwufsvny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hounbvc-c7661.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"house18.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200006962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"housebase.hercobuly.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"houseofscotland.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200006964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"howslife.com.tw"; content:"Host"; http_header; classtype:attempted-recon; sid:200006965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoxrsnpdgm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoytcuptdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hozfzevueq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpicyrfunv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hplikormuk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hplljhnouq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpmncjloie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpplotters.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200006973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hppqnoemxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hprt-4kvuhtyw.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpsqccegga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hptaqciyyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpubzomwrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpwlfchihq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpxhvtawxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpyxperctu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpzgvylybn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hqchkffqmj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hqdgunggvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hqemrkqjdt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hqgctqrlyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hqpzyzrwis.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hqwfmppvpd.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hqyyaftego.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrcxmjyfyc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrippzfwhv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrlistsofcovid-ms.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrmrifoqfc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrms.projects-codingbrains.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrndzjdmwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrnhqbpvvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrrhhrtjtjtjtj.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrrnfgdahi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrrodmqcrm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrwhmumgvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrxhnuujpf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrytbhbseo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrzrciodfi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hscfgdnmqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hscukuexje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsfiqhxtgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsgsjspqzc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hshjzexeee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsjpenmsrr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hslptzjdze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsoggftcme.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsogqrkctj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsvppjljdr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsxvfjsklw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hszc168.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htfjctuncc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htgvirkdzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htiiihhgtt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htkeyetuqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"html-update-okay99.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"html-update-okay99.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htnfebbtur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htpnsyoyzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htrxrlwpox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"httpeugnerally-wixsite-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"https-104745besyhjlhf.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"https-105195.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"httpsfojrhdnfhgcom.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200007028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"httycoupbtinfos.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htulwoylry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htunlwnqvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htuxdpwzqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htyjjmjphu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huagema20.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huainamkhun.ac.th"; content:"Host"; http_header; classtype:attempted-recon; sid:200007035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huangxc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hubfalcfnj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hublifefinancials.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hudrbddbsp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hufcbrakil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hugmhtnmbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hukiuldoas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hukwqqtdpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hulu-com-activate.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200007044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hulu-hulu-com-activate.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200007045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hulu.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200007046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"husiwei8.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"husnrymqkx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"husodipyjb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hutgtrmgqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hutkwhhavh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hutoknepper.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200007052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huuhwshcln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huuntuajsx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huusrhqtqd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huxioihzlg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huxvnnalur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huxycvrsni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huynguyen2k.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huzicimbcg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huzjizhhmg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huzsnoohyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvccomeblt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvcgeqqdjv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvcjocqkbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvdarnqvvr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvfzvebrmv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvhbfzypul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvhbivtjyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvillpzyot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvkkasbcqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvohtdclei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvricogdku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvsdutyump.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvtrbpoupt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvuazrtbwm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvvpfkyftz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvxefdtvfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvyfcpzbbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvyofpalql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwajnmcwjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwatgecgqc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwblleetml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwclcnnjkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwebotozzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwfrwyutdz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwfveihoxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwhczkkxac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwjphdypyh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwjquctmth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwluzxhszf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwotskaanw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwrdwsuvua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwuypqahpu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwwqezbzie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwxzpffyvp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwyazmfcvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwyfqenpav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwywogheyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxaxysjjzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxdpbxwbjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxeeqtnbsh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxfmjyzfwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxgznnrypr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxmpsrhsno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxtyptzhmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxujkeivdt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxvffyuood.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxwhhbkugr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxwrraxerr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxxcjmktct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxxcmlrpwo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxybuphssh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxyjhaalopeyas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hydnocrpwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hydro-globe-industrie.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyecmvquls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyfofcnvcu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyhssfqrzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyjuifmrrj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyjullnsbd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hynsejssff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyperx82hdas9o.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hypnobirthinggta.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyqiye.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyrdqwobtw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyvnzhhvuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyxgsasydj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzagyentof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzbtxdotqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzehamesqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzeylzzqpw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzgtftiwni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzholtbdkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzjoabervd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzluxejitq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hznsldmjyn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"i-ask332.dga.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200007138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"i-auth.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200007139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"i-tps.cam"; content:"Host"; http_header; classtype:attempted-recon; sid:200007140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"i.gal"; content:"Host"; http_header; classtype:attempted-recon; sid:200007141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"i.violationspage.validationspege.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iaccess-login.thaigemmart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iacjptdpty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iadebasvurumerkezi-formu.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iaemgfbfqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iaeoni.shusxzr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iaeoni.smowjng.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iagfswrhkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iajtrdpnvz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iakivqnpkt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ialixgrctn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iaoigruynq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iaoiusa.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iasrellbth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iayjamfvvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ib.resoncvzabank.co.jp.ewafqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibashr.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200007158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibcivklhls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibdazldymm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibejqykfmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iberostarhotelsresorts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibfkjietem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibgfsgcaim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibhkmxvtun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibk-clientesperu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibkluwoebn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibkzqefhcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iblujrkxsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibniuxibfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iboovggeqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibpm.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200007172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibpobaqltg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibpsconbbb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibqflsngya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibraibraa170.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibsrbwmfoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibu.com.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200007178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibvcfzzrew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibvztdqbdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibwshqdelr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icat.tg"; content:"Host"; http_header; classtype:attempted-recon; sid:200007182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icccokbrcb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iccevxvlvh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iccu-2fa.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iccu-2fa.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iccu-a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iccu-ie.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iccu-ie.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ice-poker.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icentra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icexxumqdb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ichosenimports.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icmffunmvi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icncfqleiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icoicfhtsv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icpwyokxcv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icrrczgbbl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icsconsultant.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icxsxzboop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icy-block-93df.edrees368.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icy-lab-beb.ukc904io.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icymbodhlv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"id-000064updatenow.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"id-64300000-updatenow.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"id-gandi.uv-i.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200007206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"id-optus-verify.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"id-optus-verify.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"id9658.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200007209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idealli.fun"; content:"Host"; http_header; classtype:attempted-recon; sid:200007210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idedzsrsmh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idee93.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"identificadipartimento.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ideomaker.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200007214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idesign-outlook-auth-0ffice365.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idesign-outlook-auth-0ffice365.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idgraphics-usa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idillphdmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idjnznfmoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idnrqwkhxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idobeamolax.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idolnutrition.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idqlhzyoni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idryvamyoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ids-s.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200007225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idteffrunt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idyfsuqrlp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idzhclbtvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ieddevbcid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iehkyrkzzw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ieljxqntrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ielsckcvbl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ieluisfelipecenteno.edu.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ieolbazxzc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ieoyutqdun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iepsanjosemiguia.edu.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200007236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iewbvpupdp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iewflbfrty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iewpkitttv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iezmskjblb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifflscsepy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifibybo.cluster028.hosting.ovh.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifilgglvbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifkoorofxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iframejld.avent-media.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200007245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifrorjoaia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifsmvezfzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifufbrofle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunqngaby.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifvabfyjkd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifysgymvhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igafqddskv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igccxwgssi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igflpbtbzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ighierapft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iglfjxlqnp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ignsgrwbhv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igokocejgh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igotinnovative.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igqfsodqqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igqokg.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igqpptnssg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igqtbbljgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igsolthermsolar.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iguppjvzkp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igypeapiom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igzgqaagvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihalhskfhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihblhkrveu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihdflwpvsg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihfrgzvtgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihispekcax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihmhwuotka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihofhneoah.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihpost-shopping.7864530.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihrcefyypk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihresendungistunterwegs.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihueuyekcc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihxhyfjfwz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iibndkcghb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iicconsulting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iiednrrfmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iigitcnhfm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iigsigufgp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iigwxxlzwo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iihcqxdjdy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iiink.d2if7qfe6ye8b8.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iij3x.klaastemedia.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200007288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iilaluvenm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iilaznpldw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iiplhkfqtw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iitauverifypy.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200007292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iiutefdfau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijbothaxso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijcdweybgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijdzsbqspp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijguxfcgsw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijgxlyxzlt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijirhxruht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijjnveopkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijkdrvljsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijowypqsxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijpaipkpuh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijppr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijrmmzjgzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijsvrqabsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijuwmuutpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijvlukomwm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijwhlqfxkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijxjdjncvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijzekujkmw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikcodppwco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikdvwetovi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikjbgfvpyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikkhrmanox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikncrpfodz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikqgldcqqo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikqqrajzrt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikrknhggnj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikskvbdyft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iktcmbvfqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iktlthvzdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilghvcyrsq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilhabvrvxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilidkwhkgx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilionzermelome.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilionzermelome.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iljaaicrif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ill-persa.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"illmqutnla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilnjceoqdb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilohbajxyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilpeyeree.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilrulbwdze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilvhuzcggy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilwjvrttsn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilzcrrodnq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"image-apparel-solutions90389.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imageduke.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imawxkqjud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imb.manantialdebendicion.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imbibetechnologies.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200007342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imccngffmh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imcwhljgsv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imdwuiwple.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imefylghjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imflaevfrl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imgeweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imiqjtenid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"immediate-tropical-collard.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200007350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imndehiyll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imobiliaria-cardinali-com-br.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"importvalidator.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"impotsgouv-france.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"impressivesardonicrar.yousegurityhome.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imrqbwpody.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imrzunuooe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imsuydfqvf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imtokenmart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imxwfqrcdw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imyrjtcpcd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"in-post-pl-myid272xs.kreasi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"in4ou567twch.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200007363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inanhd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inapptech.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200007365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"incandescent-pie-80d2b1.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inchirieri-limuzinebucuresti.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200007367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"incomeviaonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"incort-5458789856234508.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200007369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"incort-5458789856234509.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200007370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"indeedsupport22354.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"indeedsupport22354.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"index-afcu.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"index-afcu.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"index-hase.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"indianajons.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"indigoswap.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"indmobilelegends.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"indphgdovj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"industri.blog.unisbank.ac.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200007380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"industrialindica.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"industrynews.sg"; content:"Host"; http_header; classtype:attempted-recon; sid:200007382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"indwecfjud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inemfjmmkn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"infallible-chaum.109-206-241-201.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200007385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"infinitycleaningpro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inflixty.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info-meta-77566.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info-update-78432.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info-update-78432.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info-usr-online.preview-domain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info.dnb.no"; content:"Host"; http_header; classtype:attempted-recon; sid:200007392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info1226.systeme.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"infobper.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"infocarteameli.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inform-01.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inform-01.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"informacionesdaviplata.daviplinfor.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"informations.recovery.confiryourpage.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"informationtaxcase.page.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200007400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"informegal.656867.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"infos-novobanco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"infra001.bitbucket.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ingeswebs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inghodbe-04.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inghodbe-04.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inghodbe-05.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inghodbe-07.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inghodbe-08.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inghodbe-08.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inghodbe-1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inghodbe-1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inghodbe-2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inghodbe-2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inghodbe-5.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inghodbe-5.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inghodbe-6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inghodbe-7.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inghodbe-8.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inghodbe-8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ingreestuyaa1463.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200007421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ingreestuyaa212s.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200007422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ingreestuyaa2213.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200007423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ingreestuyphet3654.0hi.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200007424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ingres11loshf.ingresbankhome.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inhbeyzzbc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"injfykvotl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inkboduqvr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inkqsplork.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inltwrptef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inmobiliariaalfa.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200007431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inmtpqxvjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"innevio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"innovation-evotik.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"innsvfmujl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inp0st-dispatch.315873.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-asiw.order709.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200007437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-informing.8089765.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-iswu.order442.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200007439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-jcyu.order941.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200007440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-hid226ks.limello.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200007441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-my-id2g3ys.meiren1.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-my-id2g3ys.oferta.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200007443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-mynid2ihxa.garati.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-mynid2ihxa.sawadee.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200007445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-mynid2ihxa.tzdsb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-zai.accept8145.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200007447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl.payment003452.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-polska-hzl.order268.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200007450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-polska-mo.order943.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200007451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-polska-nnb.order708.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200007452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-polska-xjj.order682.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200007453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-polska-xm.order943.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200007454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-purchase.33212728.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-qvby.order9356.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200007456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-rghl.2584902.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200007457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-shopping.43222378.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-tpfl.order491.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200007459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost.order525.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200007460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost.zorekafot.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inprocal.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200007462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inps-ep.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inrnftmjtp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"insetti.com.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200007465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inshredirects.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200007466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"insidious.007sbw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inskjfjlwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inspiring-montalcini.217-160-205-21.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200007469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"insta-login.zerolinky.my.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200007470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"instagram.com.bedrijfmaju.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"instagram.orvilleyang.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"instalogin.dotkom.my.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200007473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"instintosuperior.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200007474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"insurancetrader.gr"; content:"Host"; http_header; classtype:attempted-recon; sid:200007475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"int3eractivebrokers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"integratenftpads.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"intentcandidworkspace.domingo7.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inter.prestamosper-sonales.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interactive829a.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interactivebrokers.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200007481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interactivebrokrers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interactivebrolkers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interadtivebrokers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interbank-ingresa.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interbank-personas.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interbank-peru.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interbank.banca-digital.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interbankempresahomeweb.gemsaweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interline-asia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"intermaticos-ec.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"intermobilesolutions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"international-c.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200007493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interspar.at"; content:"Host"; http_header; classtype:attempted-recon; sid:200007494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"intesasanpaoloookkk-ba7535.ingress-baronn.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200007495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"intl-ppyal-securedata.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"intramidis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"investi153716283.bychuu17639261.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"invio-richiesta-inserimento-selezionando-bnl.4nmn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"invoice-production.chat-verify.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inwmartrvv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inyejnydwv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inykgnimcl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inzizi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ioaxptjcoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iobyjalkie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ioftsqtkkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ioidkvqtks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iokakrjudb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ionos-mein.webmail.de.flick-fix.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200007510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ionos-server.s3.us-west-1.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ionos.com.ng"; content:"Host"; http_header; classtype:attempted-recon; sid:200007512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ionos.zimapp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ionosionos3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ionosionos3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iotmgmqohc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ioumpfvzja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iowrwowcne.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ip-172-22-ch.main.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200007519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ip-213-178-ch.main.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200007520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ip128.ip-15-235-36.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipbqqvntzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipevfsygcd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipfs-fleek-co.translate.goog"; content:"Host"; http_header; classtype:attempted-recon; sid:200007524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipixacademy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipko-biznes.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipko-biznes.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200007527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipkobiz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipkobiz.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200007529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipkobiznes.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200007530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipkobiznespl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipkobiznespl.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200007532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipkopolski.page.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200007533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iplogger.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200007534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iplyqxrsvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipnfrnzylh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipnqzejien.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipoaegomgk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipobmucllp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipovcon2020.ssu.edu.ph"; content:"Host"; http_header; classtype:attempted-recon; sid:200007540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipppkcmakz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipvpn055172.netvigator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipwuorkqjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqalrpluwo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqbvnnuyqc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqcu.4dq.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqcue.jetos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqcus.jetos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqcuu.jetos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqqvfbnwvz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iquluetwmo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqvvhyfmjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqvzfyuabl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqwknxnauf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqxoohudst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqxuasxwtn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqzlqahtxb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ir53rd.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ir53rd.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ircmxqbzfq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irelandsissuesmagazine.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irexpnplrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irktuqgxxv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irppsafqbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irs-confirmation-tax-federal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irs-federal-taxus-information.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irs.x1.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200007567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irsdraw.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200007568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irsdrawbk.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200007569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irsdrdo.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200007570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irshome-federal-tax-usa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irsif.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200007572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irstaxlaw.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irtpolytvl.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irvzxbalnx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iryecigvwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isaacanicama.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200007577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isauzmzomf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isbciniplm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isbighcfqo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iscyqnllbg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isdefahnbj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isfkjsdhifasbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isguypmzwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ishr.cm"; content:"Host"; http_header; classtype:attempted-recon; sid:200007585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ishsdkcraz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"islvyydejs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isnzforfwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"issugmgtlh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"istallazioneparametri.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"istitutosociale-pubblico-identita-digitale-bnl.ns1.name"; content:"Host"; http_header; classtype:attempted-recon; sid:200007591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iswokfvlbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isxcxnimqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isxykfokg84r.martincaldeyro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iszomfcuqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"it-europe564598-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itaewonclassinc4.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itaglmita.rnahe.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itau.conectcar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itau.pjdiagnostico.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itau.segurancacliente.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itau.varreduradeseguranca.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itauaccedeconfirma004099.kathe009.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itaucard.clubedepontosmultiplus.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200007604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itaucorp.rentitauuy.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itauparaguay.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200007606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itaupyltdaa.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200007607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itauseguridad.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200007608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itauvalidar55.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200007609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itaxauzlcr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itcccgmwns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itchydeafeningspyware.usua11br.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itdounmowf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itdzenjyoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itfc5hkf4q.wait-03.from-ne.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ithfgqftgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itifmbsopu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itqdavalcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itqfaitxnb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itrbyhpuhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itsmdshahin.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itsme-be-7ade2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itsme-be-7ade2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itsme-be-d12d7.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itsme-be-d12d7.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itsme-carte-730f8.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itsme-carte-730f8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itsssl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itsweblook.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ittijqrpno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ituadhbmld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itwjjbtrpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itzcdjcjjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itzdjpfabl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itzhtljtiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iubtdnplab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iuclwgumqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iudrvupawd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iuecsisbqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iulspncqrj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iunzdvzeyh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iuptnjowka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iutshdjgqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iuxydqykng.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iuzjirxoen.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivajegw32j.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200007646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivbjbtsvun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivbzfeyzyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivfcentreinindia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivfdjfjdalsfjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivflmyabhh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivitsmqtwo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivktvzpfnk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivpottgirp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivpzufdgrd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivuonpkjvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivvoeicobm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivzdbyvoug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwactrnomm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwagicvuow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwhafwwiur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwhsnozesl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwjanijchr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwjzpwmpes.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwoydsyxyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwpqusqlkc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwqodvsetf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwrvelwuog.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwrvfwfrqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwshqcbmcp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwslink.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwt2klhdfkd.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200007672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwtcgeudod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwtdjxakjs.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200007674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwtmzlcqak.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwuawmvqiz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwvbtfzvyk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwxepbrsbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwxmyqrjgk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwxvzbogqy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwyicfprez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwzmkbzezr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixbldbscux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixeabpqglr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixeoudcjkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixfdwgzcmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixgovkraxv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixiszcyigi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixmjjdzphh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixqusbeaik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixsypgbfxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixuinplscf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixzuoqmobi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixzwssckmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iyaykfwwsw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iychqasljs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iyczbsiyba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iydrutgjdo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iyedofnpev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iyfbywmlbb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iyfnxsqlut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iyfqzhyohh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iyfwmqllzo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iygrrfqmau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iylkwrexki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iypavaxvhd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iyytsdtccj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iyzbpyfbey.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izfrwwqhwm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izmelntqtp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izmvleuviv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izpllttxbr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izqaorvwac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izqigkzgld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izspwxryhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iztgtcjjni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izvdapjfrf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izvmmhydyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izxrnaqhpw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"j2219sfrgm.temp.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200007721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"j24mo.app.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200007722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jabvylmsnz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jacksoncountytalenthub.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jacobliston.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jaggedwittyinfinity.pyguser.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jagufvwacc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jahdove.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200007728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jaipurupdates.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jajaja2121.byethost31.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jajspbbhks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jam-023d.gitlab.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"james8.aidaform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jandrtrans-0utlook-auth-0ffice.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jandrtrans-0utlook-auth-0ffice.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"janex.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200007736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"januwry008.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200007737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"japezwlcey.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jarmutncff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jasa-antar-jemput-laundry-sukses.web.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200007740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jasa-bg-kakon-keman-aj-45676748767.web.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200007741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jasonsbigadventure.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jayurbatqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbc.jiopio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbcvyaegqd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbcxxqcwoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbdppqfaxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbejwpmqzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbfnmdricx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbgdsjkbll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbhedwnudy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbheimtkrf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbhgevrypq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbifaxflsr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbjhsrgbhj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbmpsfrxen.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbmugeuoyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbrefrigeracao.co.mz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbtsfnsqsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbwehfwbif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbxkvdczmi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jcaioijvru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jcdulinjjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jcfoaqnyup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jckfirs.punctulcentral.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jcpropertiesmalta.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jctblvspuw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jcvclguqgp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jcxrwljtsh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jczgybntox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jczjviomtf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdapjstymi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdbjpwhrkj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jddoguhzlv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jddzafxcyc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdgpujfqtd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdhbhfe.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdi6pct.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdmzaugomm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdrogzomez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdrpapfmbw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdseng.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200007782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdtttllcnd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdwqfenvic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdxsbvkkiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdytrcwaxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jebhezxjhc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jeejxyrqzf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jegkmrggzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jehykdhlsi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jeifrtuaen.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jelink.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200007792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jelqdtcqio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jenny-fcc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jeoxmfmpwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jeplhfbgrq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jerryscaringhandsofdc.jerryscaringhands.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jetser-electrical-supply.business.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200007798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jett.gator.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200007799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jevotdhekg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgbv.bvjlip.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgoenzcpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfhgsjggsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jflkp.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfowewbqcb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfpinpwpyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfqdmkwcuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfrmymzwgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jftllkqlgx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfuheepljh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfuryauxjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfwjcoyhgy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfyelmnfmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfzxefznxz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jg0kmi73nlcmhkl4oje4nd1a697hrpngnqb7mlpsc9eoua4naob16jg.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgaalskxmi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgadnzarlf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgfhueisfg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgfrhtygxz.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghjasfxjahxgkvy.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200007820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgielqbygb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgjrzyedgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgkgngltcl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgoiyxcxgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgpmbolsbm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgppcukvpr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgqtkegtsk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgvmfnhbgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgxgofwdmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhahnews.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhbgfkslrj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhbhtupebe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhcexumvre.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhcifdzbhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhfhdafiaooejda.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhfmpeaxwz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhgbv.cquotxv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhgjghhggjjj.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhgrtyoliutry.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhgwdhtsqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhhgrxutjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhlcvcoull.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhlsoyxyfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhlwnjqhwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhonxblvmo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhpoxpvzid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhprrrhknx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhrlpridwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhsvalbvs.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200007849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhuciktnnz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhutlmyeyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhvuxxhdjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jiaxprlkze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jifwvxdsvt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jiggsicrbg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jihdyeoxtd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jii.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200007857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jijvfymkuc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jikapremny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jinlnfmlij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jio-giga-fiber-scale-repair-service.business.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200007861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jio.hungama.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jio.network"; content:"Host"; http_header; classtype:attempted-recon; sid:200007863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jiokbclotterywinnerlist.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jiomjiufvi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jiosms.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200007866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jiostore.digitalhubstore.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200007867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjcaifrvyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjdrvcvzvg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjhkvtziof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjrpvfflhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjukmrptmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjwogpirsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjxapnatsj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjzefmqnyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjzvnyhgaj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjzwbswqjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjzxxfycml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkaclmwwpa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkakjdwgbj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkamevijmg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkcybyjosc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkdjdkekeke.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200007883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkgfhrhvh.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200007884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkgfynbzzs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkgvkpvbpi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkjdnoxapq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkjmkikows.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkkposiegv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jklmm.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200007890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jknmqubtky.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkohegpxfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkolawnservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkrxkuatzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkuhaxlmav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkvegffomy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkvxukvlpc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkxszcuscc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkyaruounx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jlarrwknsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jldjxswtlc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jljmaunwmp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jlnmiroauz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jloozavzaw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jlullykcrw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jluwhwtlqd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jlvqkcoovw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jlxeyanuza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jlxkwzscyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jlzdipzgyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmdrypmrnz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmefbfdedw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmfgbbuwnk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmhisktbdn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmhytvtkfg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmibhpylbr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmnxagzzlu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmoegzgekw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmqrnwcxje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmrdlrxeau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmtrtqpend.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmv.2p0kt9y.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmvatnyduv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmvgabtxhe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmvhknvfdx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnajajbupt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jncexchange.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jncoser.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200007928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jndejaacmr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnfevbikhq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnfute.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnhotupgjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnlmubowny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnnvbzcqqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnpost-market.6798090.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnpost-market.9051121.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnveaixmow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jo-dead-ho-gay-that-3.obs.la-south-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jobhubindia.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200007939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jobjlkbbud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jocatlneut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"joecamera.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"joefoxphoto.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200007943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"johannabraun.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"john-ashley.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200007945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"johnsoncorntrols.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"joiatrrcxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"joiroktuec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jokurqpvpt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jopjydiqyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jornaldobairrodesapopemba.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200007951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"josfyxbhyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"josorfgvya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"josqkkgmvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jotdtyamup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jovanelectrical.co.ke"; content:"Host"; http_header; classtype:attempted-recon; sid:200007956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jovial-pegasus-7a2558.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jovkycstae.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jow-japan.or.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200007959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jowpbjccel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jozodqhgzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jp-isama1zon.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200007962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpagmfevtl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpedrofernandes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpeoziwtsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpgbrcymoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpgxfhrpdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpkgymgoqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpkypokhef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jplwzztyqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpmc-unification-uat.eventfarm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpmunanqta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpndihvhrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jporsfmuxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpplsnjfnl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpt.waminclsdrive.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpwqqiplit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpxhsuiqum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jqffdsmmvt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jqhypfrxuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jqnajfoflp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jqofogqscb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jqoxeonbgk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jqrxrqnrej.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jqsaygjlgp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jqtrndbvsr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jqvsmdlwfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jqwxcrfpet.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jqxiyioppt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jrakjfxyky.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jrhxqpzdyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jrjgqhfiwv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jrmbxdauaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jrnjbfhcgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jrqscyibcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jrtinnoscj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jrufrezets.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jrxffakcqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jsddrovijj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jsgjvwrqeq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jshbtxfjpu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jshzatnmhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jskhtxfkzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jsmjhjqrrf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jsodlfgqxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jsrhjjginv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jsvgemibwt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jsvskwixdm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jswhmcxdoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jsyafsirdc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jsyjrhfmez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jszduanfuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtdnzltohh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtfjmefgml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtktykykykytluy.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtlknwgsjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtmfdxlczr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtmnupzxqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtqwpucwid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtvtesrorn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtxkgkdxxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtyigtfidz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtyrg.tl1sc905y2.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ju0.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juanesteba.xiaopangkj.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200008025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"judppamuel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"judyguth.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juevdmohtz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jufghb.ekv6deq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200008029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juhzcctocx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juialaq1819.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juiwrjgkgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jujubklucy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jujuegieji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jukirmnsaterno.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juliegr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jumbotea.work.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200008037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"june.document-project-list.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jurbycpzck.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juridaois892nba.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juridico-financeiro.viewdns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200008041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jurnalistik.uinjkt.ac.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200008042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jursjzybah.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jurunvhbuy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"justblissbyyo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"justsayingbro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jusvpuyzdo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jutughgkkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jutyuaye378ahsd.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juwmjvvazg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juwyukwarh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juyxsypjlz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvakmjbyqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvbayqzxnz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvbivcqzba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvdbfklkvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jveudufuii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvggmjqigm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvhyoiqmdp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvkiczhxhe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvkyqvznbr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvmodxynnd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvnbhrwdju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvnwerkerz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvnyjdvljs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvqqvhtirv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvspjcwrns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvuvihfjot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvvccfxhjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvxkcszbsp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvxomxomgj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvyhewqnbg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwbkbiudte.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jweemljzlc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwfibfjteb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwfpqxgrnm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwfthmkdzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwggwzzljy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwiflgobof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwivfoqjqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwjygjxvbb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwkzhgfnmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwlafgvwyk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwlullsgcl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwqxuiduab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwrpqmawau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwwkfzjmag.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jxbiqfoisi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jxblmjfeao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jxjzfccrxe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jxlwjoxnop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jxoykxmycf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jxuogltqgu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jyeue43rm95p.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jyfhwkklkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jyhpglpjyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jypbytbitm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jyqikablfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jystytnbbo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jyszwzadgt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jywufsoyoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jz2bab.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzbhyxfykc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzcnnjtugi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzdtcnekqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzfetqsoyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzfocmwskc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzicxjykls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzjoecskif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzmfrxsoge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jznmnaaamz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jznsbzebcr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzqmnipwov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzrhcnvygs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzsyzplpvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jztypldghf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzuhdommej.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzwetrczrf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzyiodskllafuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"k.axsct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"k3ja6d.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"k7dj3-ziaaa-aaaad-qdiia-cai.ic.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kaamwalibais.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200008123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kadokmxjvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kaehzhujgh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kaersole.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200008126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kafkasariotel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kaharaerad.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kajzptpwbw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kaklkoiwoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kakmnezarabotat.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200008131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kamaltraveluk.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kangabooking.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kanrxcslhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kaokbzlkkq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"karafuuru.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"karako.sytes.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200008137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kardiologiebadkissingen.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kargonova.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"karllagerfeldshop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"karllagfr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kartaltepespor.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kartoteka.muzeumtradycji.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200008143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kasarqfwsf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kasba.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200008145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kasqzvjavq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kastersoy.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200008147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"katabitc.go.ug"; content:"Host"; http_header; classtype:attempted-recon; sid:200008148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"katana-dex.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kazgaxddpg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbaredesigns.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbeicfmbbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbhlvptebc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbkhucmnqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbpujfhlir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbqocfcbpb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbuhycpjot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kccfserzux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kcdzqeafao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kcldzeqwsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kcmijbxihh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kcnqrcdgab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kcpphjbhmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kcpwr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kcqkkkevqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kctnkcrewf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kcyavbmkcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kd582.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200008168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdanuzyzht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdbduljnhw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kddwmmvyye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdedftcbbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdeegupqku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdkyrpughj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdlscaffolding.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdnjjqeenw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdrtspumzm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdswtgqhyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdsxjrpbwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"keadaancus.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kebsukmceu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kecc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kecmanijada.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kedarshirodkar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"keddwusqnq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"keepingregular.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kejeswzjjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kek-technik.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kekrnynemb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kelldjpzic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kemlidarti.flazio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kenalred.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kenxpiegah.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"keojmjpfkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kepmajpzup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"keqjabmicn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kevilsvjno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kewbnssupo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kexmtvmgpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kexupakhxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"keybolivia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"keznltiqiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kezyjciqwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfdpvirjtv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfeppnchfz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kffrrpvjhx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfhixpflae.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfiyhqgkqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfpigpdotr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfpzcjsdzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfqxlqehny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfqyrjakvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfzefqyaft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfzlkigxei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgabwbzupt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgafmlyxny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgengineering.qa"; content:"Host"; http_header; classtype:attempted-recon; sid:200008217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgftirqscw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghtxcriho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgiehrgrmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgincdtonc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgkuwyokqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgkxeqspxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgmdobwrkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgmlhwzogc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgnbpkxpgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgofbewnzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgqhfmhfuw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgzjkoperp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgzkoksloj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khalidouhdane.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khbanjcdrs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khdhersmzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khfvvcpwge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khjilyfqni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khlwhylysr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khndqkmrse.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khnpifocmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khpgzvbogq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khrzftqfwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khsgqgymjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khtahwckcp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khxfzhjexk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kiafzovfhf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kibony.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kichengate1.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kichpbaubz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kickjuice.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200008248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kicksmandu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kiedgwpxcfehkkzxjyc6i3reqo5u2wamqgxgrugkjh2fswvjazwa.arweave.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200008250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kifuduadfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kil.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kiltifwaxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kimixeanbk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kimprhhbte.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kingauthur.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200008256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kingvel.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200008257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kinibglqvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kinvtwoguv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kiovad.uno"; content:"Host"; http_header; classtype:attempted-recon; sid:200008260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kishwifi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kiskwtgcpi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kisnrmumgm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kissapps.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200008264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kissmyball.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kithocivilengineering.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kivxyyqrde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjckikpvgx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjezzxfubp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjifrehady.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjipjwuexm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjkujedtee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjljvxurpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjnfgqearb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjnqubqdmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjqnlygoqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjqnympukv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjxxpddppc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kk-asobu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kkbhmnjxve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kkbiaergki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kkbkvigaad.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kkgnzwjvac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kkllxddqvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kklyqmwqsy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kkmlgsunel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kkqgapkpyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klaimchipgratis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kldttbwwoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kleitarwoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klfdufnlbn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klfglnfavt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klgabbedba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klglejbsur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klientin-lieferung-paket.healingtobehappy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kljfdtstrlnnv.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200008296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kljpehwvya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kljuqajuuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klldexyzdf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klockorochsmycken.se"; content:"Host"; http_header; classtype:attempted-recon; sid:200008300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klogrkatpa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kloqphgjxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klos89.lajsop78.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klqguvpcxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klqkoserml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klrjoedxec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klxphiogdy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klyqloainm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klywunodwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmakeitonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmct.edu.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200008311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmctayurvedacollege.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmezelvjaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmhdnphmgv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmhetcjrip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmoquyokpw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmosuqpmdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmqpmmmlsz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmtdjnvmqo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmyljueoni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmzgzgcsmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmzsojautz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knbfsefrdb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knclzoptqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kndsoskuwm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kndxzqtbku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knfbjeooer.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kngjexhdlq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knhrgozkho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knskdnkoyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knuibloxib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knykskzkyh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knylslxaag.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knzubrjlwt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koavqlnorq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kobe-denki.co.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200008336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kodcytdplb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kodera.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200008338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koerich-c-empresarial.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koglcggrzh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koigkujsvl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koitlzguxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kojvfyfxzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kokcbxaopb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kokhdczgme.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kolachristwealth.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kolkatapetrapolebusservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kolve.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200008348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kolwyrtjkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"komdxkioab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kone-ali123-mon-site-web-cheetah-5.cheetah.builderall.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"konenkglml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"konfirmasi-identitas-facebook2022.webnode.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200008353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"konuzxbija.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koqujiamax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koscvwqwtk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koteng.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kotlrvmjmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koypes.gr"; content:"Host"; http_header; classtype:attempted-recon; sid:200008359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kozhwkxhkf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kozrhoswcl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpavlmxnxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpbaepfbhk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpccmgvuim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpddbpzdgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpegnouubr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kphcjrjccv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kphfxkzgcd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpifciutgz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpjbiamaje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpojxyurhz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpoomquske.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpoqghwjyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kppatqlgfq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpsaoxpqbc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpswtpjalj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpszkqvang.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kptbwahyoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kptstjgbmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kputfrvlum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpvhqtnjjn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpvtmgehkf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqaldqpoxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqbcoddjjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqcqzzbzqc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqhlpcjort.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqiywnnioo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqlaefxatj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqlfddsbwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqnyfrjqzm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqpfrgreuv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqrrmtjunb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqsxqxbpxt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqtjccqelb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqucsihdhr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqxaqcfryr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqysezuaeq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kr-bithumb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krczwnigod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krdrpyfgkf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kreativindia.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200008401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krfjsztclg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krgrpricse.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krhoknwlqo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krhqyqxrha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krjktvaskz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krleiaedxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krnwnxklkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krqatvlsvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krsnhbgltl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krstcvxzlm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krujmhrdab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krwshpqicu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kryptoconnectsupport.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ks-fcu.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ks-fcu.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ksap.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kseaxlhgob.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kshehqhekx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ksiqywahlf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ksk-koeln-aktualisierung.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ksk-koeln.de.sicherheitsupdates.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ksmoura.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200008423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ksojhpxhch.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kspcrjqqcw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ksqknpjshn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ksyofhboig.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ktbititiua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ktdhqxiewv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kteyvjwdgy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ktgvvnkhow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kthewzppdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ktkfafvrzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ktlgzupgkc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kttsacfbtw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ktvewoqtip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ktxpglnsvf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ktyllstajh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ktyxzbcsop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kubaxqdvon.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kubrwqoyhb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kuchkuchnights.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kucoin-auth.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kucolnmyapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kugtesyiec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kujgxrgzzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kujniqxmdk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kujzcdpzic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kulgn.weblium.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200008449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kulmjpdhkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kumceequvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kunden-konto.mymom.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200008452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kundendienst-spk-aktivierung.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200008453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kundenkonto.mymom.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200008454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kundenservice-okayupdate2022.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kundenservice-okayupdate2022.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kupkduudis.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kurdainyrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kurudlytjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kushmtrpih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvbelurwdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvfsubiejl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvhoyhpnru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvicjqbimv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvihtdxcfh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvjgjflbub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvtgthvhug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvzinetdcu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwcinyrdgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwduvxjdce.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwezgtojgp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwfjdmfmpf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwhvsgluuc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwjazrbsof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwjmsnmcvh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwjxiffhvr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwlcqyqcfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwlcwoomsj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwmcgtjegq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwnhyknblq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwnsponbpq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwnyvfgyzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwqpiulaje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwshyvujxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwuhgoqhcc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwuyogiwnq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwvunylqxb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwwoshauax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kxbtctoopa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kxfiadskdo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kxftycsnkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kxjkiufjskacxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kxnfokodhy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kxpukvfige.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kxrqxiiisq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kxsqoxgdia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kxtyrpwdnd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kxutjwvpze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kxwpdxasle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kxxzxdlorf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kyakrggqpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kybersvap.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kyblvpyqpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kyccsgpyfq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kyeqbyfgea.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kyfiifhnki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kygntwawfy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kygrnpwesv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kyjjsxtuhu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kyknbvhmbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kyleosburn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kylofjakzw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kymtmryfbv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kynxpfwkat.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kypuutwcnn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kyrinugprl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzdzyscnaw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzgkbotfkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzhezwokqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzibzsimcv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzilrckqvf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzitzitzmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzpffntsga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzsszouvde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzuchetxdi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzufpyjtug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzufrhiolh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzwmowjhew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzyxbiifsq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzzlmxcxlm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"l0g0n-1654546-ve.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200008531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"l0gin-365.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"la-technik.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200008533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"la.messagerie.vocale.orange.idsc.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200008534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"la12boca.boca1212.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"laaphqpktv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"labanque-postale-9e516.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"labanque-postale-9e516.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"labreport.lk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lacahkrukj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"laccount-netflix.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200008541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lacmduxgoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lacomarcadepuntablanca.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lacwdokgnx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"laeruzoflj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lagaleria.digital"; content:"Host"; http_header; classtype:attempted-recon; sid:200008546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"laier-p02w9ju34-hfrjn-werhngvfi9wnjfv-0whjrf-0r4ef.obs.ap-southeast-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"laiserhillacademy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lakegraham.buzz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lakeportsecretary.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lakhari.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lakossagi-mkb-hu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lakossagi-mkbhu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lala-murianos-stellar-site.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200008554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lambdaweb.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200008555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"landbank.authorizepage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"landbankiaccess.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200008557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"landcredi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lapbxekkxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"laqghsldol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"last-delivery-attempt.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200008561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lasucursalnotificaenlineasm.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200008562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lasvegasexpresscarwash.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lasyaja.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200008564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"latdjofqwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"late-haze3a7.q79jkl81.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"late-rice-0fc8.regan21.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"late-sun-545c.cruisecontrol1002473358.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"latinotravel.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"laubros.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lauchnyntf.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"launchpad.marketmaking.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200008572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"launchpadavalaunch.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lavaligiadimimi.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200008574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lavggkpvqo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lavishbisquetest.verification97.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lawxvvfwbo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"laxmrourrm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"laxqsojllu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lazhyguedm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lazndtasmr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbancaporinternet-netinterbank.pe.subarubrasov.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200008582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbancaporlnternetextracashpe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbanquepostalecerticplus.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbanqupostalecertiplsud.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbanqupostalecertiplsud.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbavlpbjll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbazgqcgpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbazscpkwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbbforlifj.page.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200008590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbc-leboncoin.20-111-18-98.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200008591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbcpaiement-com.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200008592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbdyowxgaf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbfdgnodte.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbgafszqpc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbhpzioouc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbjfztclet.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbkxdwrhay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lblgjmiegv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbliaccess.victor-marquez.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbncgxpbqo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbnpgqhwmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbpiaccess-93223212.run-ap-south1.goorm.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200008603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbpiaccess.run-ap-south1.goorm.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200008604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbsxdmtavs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbuyqakqkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lchjluzgds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lcillsfkcp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lcjkbypdct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lckygnfxew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lcmevyirzf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lcmrwbyrqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lcnlhlsgel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lcqfyvsyrq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lculemglzu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lcuzxppqrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lczrzkpkwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ldditkwvik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ldkcdhvuuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ldljpxrqrv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ldmvxtbjra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ldnpbqtkex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ldpvuihwco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ldspqiljqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lduwdukgho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ldxuelglau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"le-diablotin-rouen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"le-site-web-de-postlu1.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leadspro.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200008629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leannahats.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200008630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lear-corps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"learn.maicro.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200008632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"learn.vl286.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200008633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"learn.zb186.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200008634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"learncricut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leblancbrothers.leblancbrothers.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leccaagirz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lecteur-netfllx-log.de.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200008638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leda-hotel.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200008639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ledermaestro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leervgglxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"legend-decoration.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200008642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendeeagle.cinelegende.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200008643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lehardrrils.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leilaopatiodetran-sp.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lejztwimgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lekomosakioa.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lemitwqmoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lendingtree.assuranceinc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200008649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lenepweuwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lepygpltdm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lerdujikne.temp.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200008652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lesliefamily.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lesuqmhigm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"letzeglcce.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leviathandesign.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200008656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lew.la"; content:"Host"; http_header; classtype:attempted-recon; sid:200008657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lexedkuunx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lexgotravel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lexy.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfbpvevsou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfcqdybyqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfelixioaw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfetfrlgda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lffdsuwfiq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lffnmgrarn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfgaqzlagp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfishfish2222.hbgal8921.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfksnalsdnlasdjl.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200008669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lflqooxoud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfmuwjpqbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfnppdwamu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfnzpaicwm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfuvqtfqfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfyeuibkyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lg-comerica.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lg-comerica.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lg-onecom-io.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgaythkago.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgbgbfvpvr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgcqijzjbu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgdyimlxuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgebvdifgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgervgfiwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgesnroolp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lggjpjqymb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgkvtbgrsz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgmimrjskj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgmsbodlup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgmsroyyoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgonqrbpna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgpihyelxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgqelyvdds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgqvqcsrfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lguddjdkqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lguelbqmoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgwukufliu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgzheetxki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhbgghtbck.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhdifuwrnk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lheihaizoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhficgriym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhijfobmpd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhisneqrmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhkvczjhkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhllqdakun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhmamcrvck.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhpqztufgy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhvqnjbujk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhwagsdhbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhwqydjvfn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhxeieigov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhxinzxajn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhxxtvqfgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"libeqbysyt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liberacion-de-transferencias-a-c-h.webnode.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200008716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lieaiikvug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lienquan.garenia.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200008718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liexvmwadi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lifenet-seimie-jp.micco.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liff-gateway.lineml.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200008721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"light-office.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lightbluecloudyafkgaming.h9qh4k11.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lightcyanthirdconference.ccexpretre.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lightequine.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ligneauthenpostale.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ligneauthenpostale.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"likeme.modaa.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"likycnwczn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lilrwmovkb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"limeindianredwebpage.galiciabankin11.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"limit-orders-v2.onrender.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"limjsoaybx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lineasegura.geportal.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lingering-sun-f560.servicedeck.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lingering-violet-9e6f.cjoumm59.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"linguini773.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"linio.applytojob.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"linio68.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"link.gmreg5.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200008740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"link.untirta.ac.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200008741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lionsgate.myprintdesk.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200008742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lipnmwypzw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"little-math-4e76.m-santiago3317.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"little-sun-c135.woodedrose.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"little-wood-23ca.abssupdatedlogin.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liusanchuan.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200008747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liushtikas.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200008748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"live-scoremail.livescoremail.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"live-site.hopto.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200008750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"live.outlook22.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"live.pancakesvqp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liveconnectfix.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"livecricketworldcup.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lively.marbauttulo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liviing28765273si.infiling.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"livsioogou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lixvjacyce.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liynzmctvl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lizziguerra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljakxpdlfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljbhwcriry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljkkakpkvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljluppmrjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljmzrjeyog.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljnuqvzdia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljowzwmbqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljqlvmwlfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljqqaskixq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljsznlwuhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljvgpmnmzf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljvjwwwoaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljxaebdogh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljxffadrcd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lk.mosseo.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200008775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lkansdwxz.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lkcwvfzwlu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lkdgkugbwc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lkgccupwtg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lklyxxpcop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lkphagraux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lkqqjdrjpu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lkrerckkpf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lksxhjxirl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lktbhzuexu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lkylctswbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lkyoylufzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lkzmzmmldc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llbduqdznc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llhmylusii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llilll.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llmjutjcjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llmwbuvnoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llnuututze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lloydsbank.secure-personal-device-login.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llpnqdsawg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llqoxjpgis.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llssmmjfap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llukjscisj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llwhblnmrl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llybbhnwra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llyhugx.cluster028.hosting.ovh.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200008802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmagsvyrxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmbmibncyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmboxwnhqa.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmboxwnhqa.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmdjjoqugf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmdudsqahf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmfvzvcqip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmhblpsxsc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmkfirhsnd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmmqrgmlkd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmnaqzvxkw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmnintikzh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmnxcucrhc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmoonjnmaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmpdbmagjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmqmfbnfzs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmsgwzxcrr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmvdxyrawt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmwfjpvrtn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmyjiqewqo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnformacionlmportanteltu.panelususario.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lngjktxynx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnjoptqugf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnkllidfnf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnmbzdxdqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnnpcbajfq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnnvfhgpmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnstagramhelp.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200008830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnszmuxzku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lntjdxpwzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnvnvwrkss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnvxupqhfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnwzguekmg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnxydlrngg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnzelshcxf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnzxkodnhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loan365applican.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loansidemed.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lobnasasasa.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"local-helpdesk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"localso.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"locbsuodmz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"locewmnjpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lodzlzxiui.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"log-defikingdams.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"log-deikifngsdoms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logeoibkexclusivo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logeoibksetiembrexclusivo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loghost.pancakesvqp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-infinix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-doc-share.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-doc-share.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-doc-view.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-doc-view.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-share-1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-share-4.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-share-5.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-file-share-doc-view.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-file-share-doc-view.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-file-view-folder-1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-file-view-folder-2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-file-view-folder-4.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-file-view-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-folder-agl-coa.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-id-file-storage.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-power-share-file1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-power-share-file1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-power-share-view.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-power-share-view.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micrsoft-onedrive-signin.sansiro324wnet.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200008873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-net-micro-inv-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-review-uk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-review-uk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-share-file-folder.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-share-file-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-view-share-folder-file.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.affrm-us.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.affrm-us.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200008881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.bitkub.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200008882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.gaiiciainforma.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.info.poste.decizia.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200008884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.mizuhobanke-go-jp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.mizuhobankes-jp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.mizuhobankg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.vpasrnbc.jp.kcdhgz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login1.sitelio.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200008889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loginbncr1.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loginprim2.sslblindado.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loginx-caixa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loginyahoofrontlinehelpdesk.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200008893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logistik.bpbd.boyolali.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200008894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logmedo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logn-microsofton.shared8.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logn-mtb-online.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logn-mtb-online.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logon-review-uk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logon-review-uk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lojasmagalu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lojasvirtualon.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lojauniaomaster.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200008903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lokhmkyiwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lokminstyasa.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lomadesarrollos.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200008906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"long-disk-7d27.jonhayp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"long-mouse-deaf.silentsunrise3109.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"long-truth-fa36.yiyahamalkers.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lonos-auth.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200008910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lonoss.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200008911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loogin33ss.casoga33jj.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lookatmynewphotos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lookinqatar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"looksrare.cx"; content:"Host"; http_header; classtype:attempted-recon; sid:200008915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"looksrare.org.0xb646f4fa47a16309bf603fd805ecd222a5cd.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"looksraremarkets.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loopedcupes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lorenaboisercoulo.boisetcouleurs.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200008919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lorhcjtanj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lost.lostincovid.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"losydwrryt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lot-lp-x.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lotericainterestadual.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200008924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lotosarcondicionado.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200008925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lotusoutsourcinginc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loufk.baur-scholz.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200008927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loving-cartwright.5-42-199-43.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200008928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lovlhejkvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpcsbsulrq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpiujnxcmh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpjkprxrhm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lplbgwkjsr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpngsrcvry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpnpktiisr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpqacbuaqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lprsfurvas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpudqhchgu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpupxaxajg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpwsjdflya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpymmkdsfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpznnjyoah.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqcnahqevc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqcnqrbkxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqhcctrrvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqjliavgwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqlcxfxxaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqmybvteuq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqniwgpdvv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqnysksmzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqofjmucff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqqrrmyrbg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqrrcszjua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqsktkrjmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqsowwvyqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqwzrwxbrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqyvbexdro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrcjqiclew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrdhrxukkd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lreojflgpx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrfzgrtawe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrgqswmifb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrhkwzctyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrkgqvdwwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrmcfuuwav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrobqktlqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrqvrfpnpz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrs-office-tax-aids-finance-gov.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrvursvwcj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrxjzrimub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lsdaeszzxsa.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200008971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lsdxztzrx.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lsewdacfkx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lsflblydca.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lsgdhhnyge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lsggoppdui.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lsonngrosu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lsuerjotiz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lsvppucljy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lsxgudjwcz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lsxlddmakj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lsxtwaqtpz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lszhowqwcg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltafncticm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltdqujiyik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lthneejzwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltivbkpoko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltmgurlwlw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltmpzlyroc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltpmcyniio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltrcrzgsne.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltrhusvhll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltstpujffq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lttaiaqjfz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltvxvbpcgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luavbybpap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lub-supply.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lubvukeurz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luciavent.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lucindablackwell.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lucky-hill-75b5.ryoung8760.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lucky-rice-73a8.bizd134.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lucky-shoppers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luckybblock.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lucy-walker.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ludo14.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luejzriupm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luialvvtre.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luieizbfow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luisgc21.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lujrrifzjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luk7.lubkrout.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lumhyfbntt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lumyiqypge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lunacgrowstaking.trade"; content:"Host"; http_header; classtype:attempted-recon; sid:200009015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lusaeouzhe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lusbgonagy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lutifshxto.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luuayhlnff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luubksruoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luvafurjsq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luwtgugjza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luzfwlyyhv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luzpgxrxwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luzqjkxnyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvdlqmlrib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvdtvgtmld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvkodsgsdk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvlsllecdi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvrmyizvfg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvsjrzrukn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvumpucvex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvwdajhnug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvwupwffut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvxqbkuoba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvyixbnjfh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwbvloabiz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwjjwxonaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwjzltuvyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwmaylmbsj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwmeghakeq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwmmjamjyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwprrvqfwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwpytniwcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwqj.qqea.cryptosex.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200009045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwstqjlcjb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwtlmeuteq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwushexsqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwxagidggk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwysnsflrf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxadgreqld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxbzzcldtm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxdepsbmle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxdhippfbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxdhuvgpko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxguibnozm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxlswzxrsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxompebbye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxqbxxcoju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxtpeqvoyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxvrogbavn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxweiukcuk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxxthhuhss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyanlgmofz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lydab.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyeoqhlejc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyexjchbcw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyhgeoyomc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyirtkfbxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyixvsgfpt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyllwaqwxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lynmzvqbmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lynznubrmw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyojydhrqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyptivvsuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyrpsuizgi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyuyteauxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzdghtbace.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzgbmqdcqw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzizteevxf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzpjrhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzpkyjksuc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzrrslufza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzxppmdbtk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzxrcbnbji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzybkisrtd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m-accesso-privati-id0923.faqserv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m-sip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.fancy-bush-cf01.marhabitas.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.help.insecurpage.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.licenseplates.tv"; content:"Host"; http_header; classtype:attempted-recon; sid:200009091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.protc.safty-pege.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.recovery.safetyacount.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.recovery.saftypageupdate.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.still-band-a6a6.saftyalrt.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.super-recipe-d45d.sombodysad.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m0it1b.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m1bzz8.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m282012.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m3agence.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m3agence.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m42club.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m4agence.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m4agence.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m90.dd6.mywebsitetransfer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m9bvnr.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maaoanwhmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mabdwnqolm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macbgdbkop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macro-bienvenidos.hogaryspacios.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macro-personas.ingresasitioweb.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macrocentes.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macroenl.macroonline.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macroenli.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macroenlinea.verificacio19.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macrok-honerrpagues.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200009116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macromixa.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macrook-homer.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200009118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macroticas.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macst.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200009120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"madens.com.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200009121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maderaszuhaitz.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200009122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"madrid-web-home.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maestro.my.prod.dfg152.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200009124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magaduzela.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200009125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maggyarevalo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magiamgiashopee.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magiceden-drops.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magiceden-solana-wallet.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magicedendrop.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200009130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magicvelocityrating.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magikedene.work"; content:"Host"; http_header; classtype:attempted-recon; sid:200009132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mahikapur.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200009133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mahirarezende.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200009134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mahwsgflit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maiboxsecuredoman-att000.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200009136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maicordermyid.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maidmcierdco.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maikacordmay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail-108617.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200009140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail-ovhcloud.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail-update-100133.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail-webquota.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail-webquota.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.beauser.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.clamps.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200009146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.derbyde.ae"; content:"Host"; http_header; classtype:attempted-recon; sid:200009147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.energoservice.ge"; content:"Host"; http_header; classtype:attempted-recon; sid:200009148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.estartupchallenge-egabon.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.ims-fe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.lolwhoa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.mksc.co.tz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.pdc13.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.season15.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.soarcondicionado.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail01.moncompte.f.appsuite.default.folder.ugc.umc.edu.np"; content:"Host"; http_header; classtype:attempted-recon; sid:200009156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail1.goggle.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail1.googlle.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail11.goggle.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail2.goggle.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail2.googlle.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail3.goggle.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mailer7.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mailhost-auth.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mailhost-auth.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mailinc.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mailonlineaccessaccountverification.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mailpagesupport13.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mailplusrolerequestedprivatemailupdates.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mailserver7656566.blob.core.windows.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mailwebmaillersde.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"main.d351gzhz879su7.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"main.d3ovwyq40gg8db.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mainbibanres.store"; content:"Host"; http_header; classtype:attempted-recon; sid:200009174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mainetportals.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mainnetdappbot.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"majcofkeqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"majesticmeads.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"majorlovelybackup.bamking2.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"make.clading.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"makermining.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"makeshort.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200009182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"makstcs-go.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200009183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"malachitecapital.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"malaprontaargentina.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200009185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"malgritrarkna.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"malibuesportiu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"malwarebucket.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mamachumbas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mamifoundation.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mamkefu.kanuomei.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"manage.cisn10000062910011.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"manage.hexateron.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"manageaccountsignunknown.shock-srv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"managearubas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"managementsupports95651918.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mancataconsegnacard.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mandatorydeal.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200009198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mangoad.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mans-usa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"manskxvowc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mapsa.com.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200009202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marcelotoledo.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marcorals.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marjunirtas.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mark2design.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"market-mcsgo.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200009207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marketing.parsecengenharia.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200009208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marketplace-axieinfinity.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marketplace.axieinfinity.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200009210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"markos.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200009211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marlonmedia.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200009212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marrgiuxqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marshall.school.nz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"martin4dc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"martinfernando.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maruaykub.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maryamghasemi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masaeli2.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200009219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.mfwrsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascoosoerd.mascesccrerd.mgjuxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascosoerd.mascescrerd.mgjuxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascosoerd.mascescrerd.msnwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascosoerd.mascescrerd.qxkahc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascososoerd.maseccescrerd.qxkahc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascsosoerd.masecescrerd.rkbxko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masecoocsoersd.moasecsecsccrerd.gnpais.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maseseoicsocsoersd.emsoacseueosccescrerd.gnpais.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mashraqisteel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masleevetunisie.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masteracademy.mn"; content:"Host"; http_header; classtype:attempted-recon; sid:200009232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mastologia.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200009233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maswzmlvup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"match.lookatmynewphotos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"matchnc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"matgdlphfq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mathelin-teinture-tissus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"matketlaceaxelndinide.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"matrimoniocivil.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200009240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"matsostsey.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mattys.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200009242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"matumculwj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"matxhzoyop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maupzhchwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maxcapitalinc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maxchodorow.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maximus-hiperzinha.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maxvaloan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maya.in.ua"; content:"Host"; http_header; classtype:attempted-recon; sid:200009250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbapercuhz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbarquitecto.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200009252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbazxxlgbg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbcljggatn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbdecmukee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbhyfgxjvv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mblfumajxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbnern.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbubpinjbi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbuqiadslu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbxmsjvant.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbxqyrcwea.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbysxlsjgm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mc-003.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcbopoazak.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mccarthyelectrical.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcclainmua.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcconcep.cluster005.ovh.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcconivcya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mceqknukvq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcfsqqbdlr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcgnglgblt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mchganistore.solofolio.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mchtyhzluj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcidpnmdsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcjsbcnmhg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcmjqtimpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcqeqyiein.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcteycoxld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcucdxzgou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcvicjzxxz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"md-72.whb.tempwebhost.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdaonzkawp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdbmtmbgkt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdbxqbndym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdbyufxmqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdgpiyalgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdhplrgnrr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdhslxtzin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mditjifxbs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdkqcercnu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdlmvuxtud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdmblwhggy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdnlvttehy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdoacbxgqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdqzheykxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdsbftstmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdukrvspiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdwqwehlzg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdzxpodz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"me-sys-design.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"medelinahealth.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"medicare-gov-au.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"medicare-gov-au.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mediterraneanholding.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"medo.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200009306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meek-cucurucho-131c81.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meeps.special-mint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meeting-23900123090123.bitbucket.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meetstevesherman.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meeyonwwpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"megaparseonalse.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"megicedem.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"megkjqjegd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meicadoyuq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meine-postbank-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meiocredmyid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mekoqumjjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"melfpstvge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"melissaneub.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"melloni.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200009321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mellow-sawine-348630.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"member.doyajimo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"membersiberostartheclub.com.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200009324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"memelandofficial.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"memoriamapu.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200009326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mendami.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mercado-libre-kodc1b4lc-stivendz.vercel.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mercari-cardc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mercari-cardju.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mercari-cardmn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mercari-cardmu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mercearialopes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"merdwuuaog.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mertes-sharedfolder-0fficedocs.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mertes-sharedfolder-0fficedocs.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mesacanada.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mesdoconsumidoragosto.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"message-webapp2242022-1311426938.cos.ap-nanjing.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"messagecenter.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200009340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"messagerie-orange210.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"messari.cx"; content:"Host"; http_header; classtype:attempted-recon; sid:200009342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"messengerverifyaccess.elementor.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200009343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mestertignseekjet4.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mestertignseekjet5.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mestertignseekjet6.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mestredaobra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-adaccount-appealform92814.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-advertise-violation-12687.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-advertise-violation-12687.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-appeal-120650562.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-appeal-120650562.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-appeal-187569812.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-appeal-187569812.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-review-128792515.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-review-12897659.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-review-12897659.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-review-129867912.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-review-129867912.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-review-192869219.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-review-192869219.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-review-198609022.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-review-198609022.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-settings700122.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-11-20985212.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-11-20985212.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-11352-326332.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-11352-326332.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-122-1093681.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-122-1093681.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-1221-02198691.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-1221-02198691.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-1262-19869012.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-12677-429186.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-12677-429186.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-13125-316364.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-13125-316364.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-14856-426364.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-14856-426364.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-150-259182691.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-150-259182691.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-1526-21609812.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-1526-21609812.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-15391-717501.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-15391-717501.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-16349-14749.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-16349-14749.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-41693-19744.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-41693-19744.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-42413-11614.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-42413-11614.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-review-10928691.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-review-10928691.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-review-12599052.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-review-12599052.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-review-12875621.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-review-12875621.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-review-129788912.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-review-129788912.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-review-1926598122.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-review-1926598122.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-review-9128691.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-review-9128691.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-violation-12929862.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta.case10000550105151.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta.caseid10000634693451.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta.id1000257642165.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metacase.id10002898563462.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metacase1000510011.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metacase1000510011.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metacase1000530261.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metacase1000530261.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metacase106524672.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metacase106524672.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metacaseid.128793234256.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metaciteacn.noisy-scene-1d5c.rcvrypegsfty.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metacsnid1000521351.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metacsnid1000521351.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metafacebook100002541.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metafacebook100002542.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metafacebook100002543.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metafacebook100002544.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metafacebook100002546.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metafacebook100002547.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metafacebook100002548.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metafacebook100002549.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metafbhelpp1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metafbhelpp1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metahelp.454654321131.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metahelpsupp.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metahelpsupp.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamakwallet.unaux.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamarkkyc.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-2au.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-ad.infinityfreeapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-br.jhone.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200009436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-extension-official.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-extension-web3-dapps.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-extension.com.hsurge.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-nft.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-partenaires.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-r.jhone.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200009442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-wallet-security.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-wallet-verification.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-wallet.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200009445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.cash"; content:"Host"; http_header; classtype:attempted-recon; sid:200009446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.cm"; content:"Host"; http_header; classtype:attempted-recon; sid:200009447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.en.download.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200009448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.financial"; content:"Host"; http_header; classtype:attempted-recon; sid:200009449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io-defi-web3-dapps-and-nfts.eugeneareahomevalue.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io-studio-dev.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200009451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.community-support.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200009452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.camostory.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.estudiogr.com.py"; content:"Host"; http_header; classtype:attempted-recon; sid:200009454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.groupegerminal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.hotspotmassage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.laboratorium.bnn.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200009457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.nandawahyubi.my.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200009458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.okwcq.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.roox.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200009460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.tigertiao.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.vaskoristov.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.vermogentech.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.security-breach.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200009464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.web8548.web07.bero-webspace.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200009465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.study"; content:"Host"; http_header; classtype:attempted-recon; sid:200009466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask004.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask2.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200009468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskaa.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskab.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskc.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200009471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskchat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskcommunity.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskey.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaski.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200009475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskr.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200009476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamasks-validate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamasks.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200009478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamasksupport.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskwallet.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200009480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskwallet.easy.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metapoint6005801.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metapoint6005806.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metapoint6005809.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metapoint6005810.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metarape.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metarnesk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metaverifizaiona.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metaverifizaiona.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metavip.win"; content:"Host"; http_header; classtype:attempted-recon; sid:200009490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metavuliton30005911.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metavuliton30005912.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metavuliton30005913.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meufgts.app.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200009494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mewlrxbmit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mewscc09.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mewwallet.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200009497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfacebook-help-100029455684702.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfacebook-help-100029455684702.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfacebook.blogspot.com.cy"; content:"Host"; http_header; classtype:attempted-recon; sid:200009500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfacebook.blogspot.lt"; content:"Host"; http_header; classtype:attempted-recon; sid:200009501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfacebook.blogspot.rs"; content:"Host"; http_header; classtype:attempted-recon; sid:200009502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfcsjoupve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfelrzzkoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfetywrbod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mffhpngqlg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfhsufvmss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfiylbhsmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfjhptbcuh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfnybwsuef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfoazoqeju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfpbxzrjmz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfskfhwdzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfvapbvdjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfxehzwqds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgdigztpft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgecpfjsqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgfqkmirvj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mggbtwiups.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgiiuuucgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgmfhjwckh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgnwnzugui.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgpbwilfgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgpnyxemtd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgudbxuots.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mguxwpyafl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgwnzpigqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgxukjlwvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhiwyleahn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhnktgqxov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhpitrqnze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhpkbauybk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhpykmemev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhukzidefh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhuyauhfdsgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhvfvwvawf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhvxuxfxgi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhyingshi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miamibeantobar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miasuke.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mibancocrece.com.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mibebeva.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mic-cinautheticate.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micaerd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micards.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micasrd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"michaelmalatin.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"michelearris.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micoedmyidjp.buzz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micoedmyidjp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micoedmyidjp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-file-share-folder-dbtc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-file-share-folder-detc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-file-share-folder-mctc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-file-share-folder-shtc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-file-share-login-drive-folder.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-file-share-login-drive-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-file-share-login-drive.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-file-share-login-drive.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-login-share-file-device.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-login-share-file-device.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro50495045045.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro50495045045.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"microcav.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200009564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"microsfotoffice86572.jogengineerin.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"microsoft2210.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"microsoftwebserver.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200009567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mictrnntuc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micuenta01.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micuernjpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"midatack.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"midwesthomesinc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mienyoknyasaku.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200009573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miezuhaboenk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mifdaturen.sch.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200009575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mifjxchijl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miiniihiper.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miiqewkuyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mijfsbbicp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mijnkvkwebdesk.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mijrb.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200009581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"milonsquashclub.synergeelabs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"milton-exhibits.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"milwaukee8.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"milwgjxfzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"milyoner.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200009586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mimajzqqlb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mimbutijiw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mimkyuoyru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"minerlee.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mingming20160152.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mingshouxin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"minha-fatura-agora-z5i3d6f.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"minha-fatura-setembro-f5-br0.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"minhaclaronetresidencialapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"minhatvdigital.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ministrant-zemsta.click"; content:"Host"; http_header; classtype:attempted-recon; sid:200009597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miniurl.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200009598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mintbot.art"; content:"Host"; http_header; classtype:attempted-recon; sid:200009599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miranjint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mirmttrjfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miropftjjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"misomassage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"missionshashank.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mistorei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"misty-band-34a2.bizd134.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"misty-credit-a641.george72972323.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"misty-field-7007.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"misyvqimef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mit-alert01a.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mit-alert01a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mitbvrynow.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mityurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miurausa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mivqwxsghm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mixup201104.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miziahubosaek.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miziha-basnk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizihaubosaek.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizihbubosaek.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miziho-back.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizihubosaek.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizuhabonk-japan.uctionmax.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizuhabonke-japan.bartholoms.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200009624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizuhi-bakk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizuho-bask.btdia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizuho-bask.ccdgi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizuho-bask.xlwyc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizuhobank.confirm-update-jp.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200009629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizuhobank.tyfjhg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizuhobank.zzrhzp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizuhobanks.confirmi-japan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizuhobanks.reply-japan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizuhomk.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200009634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizuhu-bask.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200009635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjafbgpwyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjayme9jdg9izxixmjeydgg.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjayme9jdg9izxiymjnyza.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu1heta1dgg.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu1hetezmtj0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu1hetgym3jk.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu1hetizmtl0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu1hetqymhro.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu1hetu3dgg.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu1hetuymhro.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu5vdmvtymvymji5dgg.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu5vdmvtymvymtexdgg.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymuf1z3vzdde4mtf0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymufwcmlsmde5dgg.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymup1bhk0mtf0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymup1bhk1mtr0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymup1bhkzmtn0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymup1bmu0mtf0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymup1bmuymzfzda.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymuphbnvhcnkxmzv0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymurly2vtymvymjiyn3ro.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymvnlchrlbwjlcjizmxn0.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjcrcuvitt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjdeainssd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjephtwtrl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjfioxnmus.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjfyfyhyzg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjjxjuwomc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjlyeaanah.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjmcuyzduk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjmzjemakf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjpojpkuan.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjtsckpezb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjvjwjlslo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjzzf-fqaaa-aaaad-qddma-cai.raw.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkbhunet.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200009671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkbhunet.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkcfmzpivf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkctlyqcem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkcwpspjef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkdpipiuwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkfgvfqmtg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkhepkozap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkhodmjrvr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkhwhgqlpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkjlmsnqvl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkmiofecwt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mksdmdhali.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mksjtedlhf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha1.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha10.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha12.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha13.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha14.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha15.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha16.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha17.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha18.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha19.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha2.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha20.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha6.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha7.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha8.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha9.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvjune22.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvredirects10.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvredirects2.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvredirects3.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvredirects4.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvredirects5.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvredirects6.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvredirects7.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvredirects8.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvredirects9.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkwuvggavo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlaoyejwqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlbyqzayot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlckyplgdi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlgvcklcwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlhblvjvow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mligoeprsv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlmknkxteb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mloroonjxf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlpkrkozzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlpvxjgsez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlrtghbudv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlsridxkxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlszdjugtx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mltpoebxko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlujonibvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlvvjwjpik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlwcxgxpgx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlyvcpwaxt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlyvwaijzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mm88icon.bet"; content:"Host"; http_header; classtype:attempted-recon; sid:200009732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmercadolivre.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200009733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmgggod.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmgggod.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmkc.seguridadp3.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmmejjgrhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmnmuelrta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmoemoappz.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmqmfiepid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmqwnlmppv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmqwybittm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmskwlemxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmsnoreplysms.flazio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmsuinforma.animunomo.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmtzlnacrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmubqgrjwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmylmyqepa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mn-finamce.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnaxiczigj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mncxmznfaas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mncziwccvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnesirjfxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mngbkbvffi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mngrzgfntp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mniu7sfbsaiack.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnkgracingteam.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnlcrntaaw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnmblsfbjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnopbxbwav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnosvfnwyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnqdwnjqyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnqgunvfvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnsgdehbtt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mntsuregye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnxhgxdrfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnxylyhxwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnyuplhxto.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnzorbjfcg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mo.cu.edu.eg"; content:"Host"; http_header; classtype:attempted-recon; sid:200009770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mobiadvanced.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mobile-account-au.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mobile-account-au.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mobile.meta-pages.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mobile.revenue.services.6ud6w.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200009775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mobile.revenue.services.oy5vz.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200009776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moblepzisfrl.t.justns.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200009777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mod-formulary-welcome.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200009778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"modulazionecarte.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moduloidentificativo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"modxmatkai.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moelink.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mofafgncex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mofgzazczm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mogiceneden.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mohwupphgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moicerbarbyco.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moicerbarbyco.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moja-paczka-pl-myid576xs.adisetiawan.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moja-paczka-pl-myid576xs.aeldo.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200009790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moja-paczka-pl-myid576xs.zlagu.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200009791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"molalasa.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200009792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"molyyponwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mon-easy.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mon-easy.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mon-espace-orange.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mon-token.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monapigoogle000.page.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200009798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monespaca.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monhfood.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monirshouvo.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monitorpopular.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200009802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"montessorinttc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monumaning.mom"; content:"Host"; http_header; classtype:attempted-recon; sid:200009804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monyeward.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monzo.login-cancel.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mooceersjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moozatech.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moqmxyhbty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"morning-glitter-2e87.filedownjs.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"morning-limit-8833.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"morning-river-261d.img-datings.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moryjedgnv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"motostationpro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mourtwexz.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moved.sytes.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moveislojinha-app.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"movjnlprqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mozyceramik.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mozyhwwlrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mp-logincliente.siteprofissional.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpbbjqnwqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpdnylnmxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpdytcoaou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpejxrtsea.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpexxngknz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpjkwfhwpd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpkcxyrcpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpljqhqeub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mppfxtqpda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mps1-filiale1.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mps10-filiale10.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mps14-filiale72.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mps20-filiale22.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpsicuro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpsienaprotezionefrodi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpsienaserviziostorno.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpsito.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpvkvpaymi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpwdkaccna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpwxjjujhi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqavuqgegp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqgcgrkxfw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqjwialsvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqlwlixhjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqlxqgqegl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqmsretgwz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqnvkdwktw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqonkhyyil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqrpobmlho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqtzodgdqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mquyrowggm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqvdpfwzjr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqxfxqankv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqxylgelac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrecaawning.com.my"; content:"Host"; http_header; classtype:attempted-recon; sid:200009856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mreqimasmv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrilbdiufm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrjxcaydjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrlaotefvz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrmglldzcc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrpmwpfizn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrqtgfwslx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrvuavdrsf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrzcbrxxfy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ms-sharedfile-nd.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ms-sharedfile-nd.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msbhzrsnys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msc-doelsach.at"; content:"Host"; http_header; classtype:attempted-recon; sid:200009869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mscqsgtbuk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mscwulkjbw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msdfothar.amdcnon.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msdlepnceo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msg-americafirst.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msg-americafirst.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mshthlnbku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msjetlmgdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msjodbcipm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mskveqqlwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mslkgjcshl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msmnohdcwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msmvpgvcoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msmxcdfjvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msn-security-project.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msn-security-project.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msnhsmviha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msofficemessagescenter-1.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200009887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msolixvusc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msomxfbhyg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msqtwkvdul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msquarefurniture.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msrprwwqsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mstnbhsdak.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mstodd.mymom.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200009894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msyvmwjwio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mt-b944c9.ingress-comporellon.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200009896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mt-bank.squizofriend.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mt-e0a64.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mt-e0a64.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mt-fhgmc.ondigitalocean.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtask-pr01.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtb-247-sec00.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtb-247-sec00.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtb-ensurelogin.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtb-ensurelogin.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtb-smsapp.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtb-smsapp.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtb.gotdns.ch"; content:"Host"; http_header; classtype:attempted-recon; sid:200009908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbank.vegatyme.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbankfixx.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbankverifynow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbbankonline.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtblogin-mtb0.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbtranserror.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbtranserror.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbverifytrans.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbverifytrans.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbviednls.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200009918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtcjeigwfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtcuftebvi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mthaqbvxth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtlogin-verify.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtofwzhyez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtowejfqqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtqwscqbaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtrsteel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mttjwjlpni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtubkihcut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtxeoobmfs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtxesyxevv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muamyplaoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mub.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200009932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mubarakimteaj.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mucucnpntq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mudd.marpuasanotice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muddgnjybm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muddy-ayya.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muddy-dawn-b613.sharepoinx.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muddy-dawn-e382.cdn-image.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muddy-frost-ee54.henhigay285.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mueslisvvap.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mueslisvvap.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muibicvdlq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muigfzszez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muimirvcxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muivszzoiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mukhkelinv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"multi-coinpad.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"multi-coins.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"multiwalletconnectbot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mumsturn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mumuwasas-dynamite-site.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muozvzdwxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"murkasikoterma.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"murlidharrope.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muryhmjxla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"music.zhurek.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200009957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"musing-swanson.37-221-65-205.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200009958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"musoifsvqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mustahil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mute-fire-2a45.dealwaterpalmwe.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mutyqiscot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muyqmgluij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muzgwvzssq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvakoyryuk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvbwhogtfg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvbyncauxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvcas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvddcyeyau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvdtgqlllc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvellolandingpage.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvhadhidvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvjjtvzrbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvjyjlwfmh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvmyakcbbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvqaadourq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvszpqyc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200009977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvtrccfaov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvvbjbzaob.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvvxeyqnnq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvxalvhqgf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvzmjkxosw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwctakjixg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwdtimgsoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwjoqvvfcr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwrbcedpnt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwsdmbehqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwshwiwngt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwsvauehas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwtbqnhtmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwtnsbrrpb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwtqnmrrgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwtudmzhlq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwwblwqmjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwwioiplgu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwxkshtnfz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mx201.bank-online.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200009997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mx202.bank-online.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200009998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mx203.bank-online.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200009999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mx204.bank-online.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200010000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mx208.bank-online.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200010001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mx212.bank-online.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200010002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mx223.bank-online.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200010003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mx229.bank-online.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200010004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mx234.bank-online.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200010005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mx248.bank-online.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200010006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxainodvdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxatnidxwj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxbeudskrf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxmfdingsh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxmlxpjmgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxqpzeqeyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxrcovtoms.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxrr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxsclbdjxt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxsnzhjyze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxvdmszcyc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxvtwshdmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-bithumb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-business-106557-108367.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200010020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-business-106676-101333.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200010021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-business-107423.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200010022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-citi-resource.bwtmumo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-citi-rser.kamsuletri.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-citi-upd.bwtmumo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-citiserve-res.weroloko.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-ehtrip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-kam-account-cyon-ch-kam.pedesd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-posta.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-posta.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-site-102439-103169.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-site-108723-106421.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-site-silahkan-konfirmas-akun-anda088.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-tsc3cardipulic.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200010034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-yahoo-105027-104057.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200010035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.commbank.0au.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200010036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.commbank.1au.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200010037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.commbank.au-4.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200010038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.commbank.au-5.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200010039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.heyform.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200010040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.netteveri.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myadd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200010042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myaeerejacercbook.moyjaacansceor.cxwgjq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myappbtsecurebusiness.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200010044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myatt-account-update.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myboxxofice.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mybperrverificaonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mybroadband7140002.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200010048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mybusineygtgggg.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200010049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mycb-d07e3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mycb-d07e3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoencoeeb.ceosnacoen.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoencoeeb.ceosnacoen.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoencoeeb.ceosnacoen.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoencoeeb.ceosnacoen.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoencoeeb.ceosnacoen.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoencoeeb.ceosnacoen.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoencoeeb.ceosnacoen.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoencoeeb.ceosnacoen.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoencoeeb.ceosnacoen.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoencoeeb.ceosnacoen.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoensoeob.ceosnacoen.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoensoeob.ceosnacoen.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoensoeob.ceosnacoen.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoensoeob.ceosnacoen.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoensoeob.ceosnacoen.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoensoeob.ceosnacoen.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoensoeob.ceosnacoen.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoensoeob.ceosnacoen.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoensoeob.ceosnacoen.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoensoeob.ceosnacoen.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneeb.ceosnaco.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneeb.ceosnaco.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneeb.ceosnaco.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneeb.ceosnaco.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneeb.ceosnaco.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneeb.ceosnaco.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneeb.ceosnaco.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneeb.ceosnaco.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneeb.ceosnaco.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneeb.ceosnaco.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneob.ceosnaco.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneob.ceosnaco.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneob.ceosnaco.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneob.ceosnaco.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneob.ceosnaco.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneob.ceosnaco.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneob.ceosnaco.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneob.ceosnaco.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneob.ceosnaco.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneob.ceosnaco.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myciti-serv.mytihoru.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mycomputer2000.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mycutbuddies.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mycvmuzeen.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mycxxstqvh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mydappswalletconnect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mydentalclinic.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200010098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mydooog.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myee-bill-update.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myee-support-id.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myentcu.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myentcu.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myerbooxwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myevri-redelivey-item.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myfleshnblood.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myiccu.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myiccu.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myidmiocerdco.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myintegrate.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200010110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myislavista.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscciaasoenoeeeb.ceosnacoen.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscciaasoenoeeeb.ceosnacoen.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscciaasoenoeeeb.ceosnacoen.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscciaasoenoeeeb.ceosnacoen.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscciaasoenoeeeb.ceosnacoen.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscciaasoenoeeeb.ceosnacoen.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscciaasoenoeeeb.ceosnacoen.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscciaasoenoeeeb.ceosnacoen.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscciaasoenoeeeb.ceosnacoen.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscciaasoenoeeeb.ceosnacoen.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscciaasoenoeeeb.ceosnacoen.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscciaasoenoeeeb.ceosnacoen.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscciaasoenoeeeb.ceosnacoen.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscciaasoenoeeeb.ceosnacoen.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsccicasoenoeoeb.ceosnacoen.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsccicasoenoeoeb.ceosnacoen.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsccicasoenoeoeb.ceosnacoen.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsccicasoenoeoeb.ceosnacoen.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsccicasoenoeoeb.ceosnacoen.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsccicasoenoeoeb.ceosnacoen.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsccicasoenoeoeb.ceosnacoen.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsccicasoenoeoeb.ceosnacoen.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsccicasoenoeoeb.ceosnacoen.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsciaaenoeeb.ceosnoen.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsciaaenoeeb.ceosnoen.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsciaaenoeeb.ceosnoen.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsciaaenoeeb.ceosnoen.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsciaaenoeeb.ceosnoen.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsciaaenoeeb.ceosnoen.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsciaaenoeeb.ceosnoen.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsciaaenoeeb.ceosnoen.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsciaaenoeeb.ceosnoen.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscicaenooeb.ceosnoen.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscicaenooeb.ceosnoen.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscicaenooeb.ceosnoen.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscicaenooeb.ceosnoen.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscicaenooeb.ceosnoen.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscicaenooeb.ceosnoen.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscicaenooeb.ceosnoen.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscicaenooeb.ceosnoen.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscicaenooeb.ceosnoen.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeeb.ocenacoen.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeeb.ocenacoen.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeeb.ocenacoen.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeeb.ocenacoen.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeeb.ocenacoen.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeeb.ocenacoen.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeeb.ocenacoen.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeeb.ocenacoen.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeeb.ocenacoen.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeeb.ocenacoen.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeeb.ocenacoen.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeob.ocenacoen.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeob.ocenacoen.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeob.ocenacoen.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeob.ocenacoen.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeob.ocenacoen.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeob.ocenacoen.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsoieccacasoenoeeb.oceosnacoen.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsoieccacasoenoeeb.oceosnacoen.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsoieccacasoenoeeb.oceosnacoen.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsoieccacasoenoeeb.oceosnacoen.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsoieccacasoenoeeb.oceosnacoen.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsoieccacasoenoeeb.oceosnacoen.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsoiecccsasoenoeob.oceosnacoen.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsoiecccsasoenoeob.oceosnacoen.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsoiecccsasoenoeob.oceosnacoen.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsoiecccsasoenoeob.oceosnacoen.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsoiecccsasoenoeob.oceosnacoen.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsoiecccsasoenoeob.oceosnacoen.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsoiecccsasoenoeob.oceosnacoen.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsoiecccsasoenoeob.oceosnacoen.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsoiecccsasoenoeob.oceosnacoen.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsoiecccsasoenoeob.oceosnacoen.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaecccsasoenoseob.ceosnacoen.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaecccsasoenoseob.ceosnacoen.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaecccsasoenoseob.ceosnacoen.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaecccsasoenoseob.ceosnacoen.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaecccsasoenoseob.ceosnacoen.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaecccsasoenoseob.ceosnacoen.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaecccsasoenoseob.ceosnacoen.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaecccsasoenoseob.ceosnacoen.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaecccsasoenoseob.ceosnacoen.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaeccsasnosob.ceosnaen.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaeccsasnosob.ceosnaen.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaeccsasnosob.ceosnaen.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaeccsasnosob.ceosnaen.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaeccsasnosob.ceosnaen.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaeccsasnosob.ceosnaen.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesacccasasoenoeeb.mceosnacoen.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesacccasasoenoeeb.mceosnacoen.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesacccasasoenoeeb.mceosnacoen.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesacccasasoenoeeb.mceosnacoen.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesacccasasoenoeeb.mceosnacoen.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesacccasasoenoeeb.mceosnacoen.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesacccasasoenoeeb.mceosnacoen.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesacccasasoenoeeb.mceosnacoen.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesacccasasoenoeeb.mceosnacoen.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesacccasasoenoeeb.mceosnacoen.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesacccasasoenoeeb.mceosnacoen.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccasoeoeeb.mceoacoen.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccasoeoeeb.mceoacoen.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccasoeoeeb.mceoacoen.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccasoeoeeb.mceoacoen.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccasoeoeeb.mceoacoen.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccasoeoeeb.mceoacoen.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccasoeoeeb.mceoacoen.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccasoeoeeb.mceoacoen.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccasoeoeeb.mceoacoen.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccasoeoeeb.mceoacoen.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccasoeoeeb.mceoacoen.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccoiasoensoeeb.ceosnacoen.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccoiasoensoeeb.ceosnacoen.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccoiasoensoeeb.ceosnacoen.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccoiasoensoeeb.ceosnacoen.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccoiasoensoeeb.ceosnacoen.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccoiasoensoeob.ceosnacoen.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccoiasoensoeob.ceosnacoen.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccoiasoensoeob.ceosnacoen.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccoiasoensoeob.ceosnacoen.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccoiasoensoeob.ceosnacoen.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccoiasoensoeob.ceosnacoen.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccoiasoensoeob.ceosnacoen.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccoiasoensoeob.ceosnacoen.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccsasoenaseeb.ceosnacoen.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccsasoenaseeb.ceosnacoen.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccsasoenaseeb.ceosnacoen.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccsasoenaseeb.ceosnacoen.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccsasoenaseeb.ceosnacoen.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccsasoenaseeb.ceosnacoen.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccsasoenaseeb.ceosnacoen.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccsasoenaseeb.ceosnacoen.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccsasoenaseeb.ceosnacoen.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccsasoenaseeb.ceosnacoen.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccsasoenaseeb.ceosnacoen.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccoioenoeeb.ceoscoen.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccoioenoeeb.ceoscoen.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccoioenoeeb.ceoscoen.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccoioenoeeb.ceoscoen.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccoioenoeeb.ceoscoen.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccoioenoeeb.ceoscoen.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccoioenoeob.ceoscoen.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccoioenoeob.ceoscoen.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccoioenoeob.ceoscoen.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccoioenoeob.ceoscoen.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccoioenoeob.ceoscoen.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccsaenaeeb.ceosnoen.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccsaenaeeb.ceosnoen.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccsaenaeeb.ceosnoen.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccsaenaeeb.ceosnoen.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccsaenaeeb.ceosnoen.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccsaenaeeb.ceosnoen.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccsaenaeeb.ceosnoen.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccsaenaeeb.ceosnoen.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccsaenaeeb.ceosnoen.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccsaenaeeb.ceosnoen.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccsaenaeeb.ceosnoen.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccsaenaeeb.ceosnoen.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescsccasasoenoeob.mceosnacoen.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescsccasasoenoeob.mceosnacoen.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescsccasasoenoeob.mceosnacoen.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescsccasasoenoeob.mceosnacoen.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescsccasasoenoeob.mceosnacoen.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescsccasasoenoeob.mceosnacoen.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescsccasasoenoeob.mceosnacoen.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescsccasasoenoeob.mceosnacoen.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescsccasasoenoeob.mceosnacoen.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescsccasasoenoeob.mceosnacoen.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccocasoenoeeb.oceosnacoen.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccocasoenoeeb.oceosnacoen.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccocasoenoeeb.oceosnacoen.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccocasoenoeeb.oceosnacoen.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccocasoenoeeb.oceosnacoen.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccocasoenoeeb.oceosnacoen.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccocasoenoeeb.oceosnacoen.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccocasoenoeeb.oceosnacoen.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccocasoenoeeb.oceosnacoen.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccocasoenoeeb.oceosnacoen.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccocasoenoeeb.oceosnacoen.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccocasoenoeeb.oceosnacoen.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccocasoenoeeb.oceosnacoen.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccosasoenoeob.oceosnacoen.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccosasoenoeob.oceosnacoen.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccosasoenoeob.oceosnacoen.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccosasoenoeob.oceosnacoen.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccosasoenoeob.oceosnacoen.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccosasoenoeob.oceosnacoen.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccosasoenoeob.oceosnacoen.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccosasoenoeob.oceosnacoen.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseasooeob.mn.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaessccasoeoeob.mceoacoen.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaessccasoeoeob.mceoacoen.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaessccasoeoeob.mceoacoen.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaessccasoeoeob.mceoacoen.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaessccasoeoeob.mceoacoen.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaessccasoeoeob.mceoacoen.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaessccasoeoeob.mceoacoen.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoocaoenoeeb.oosnacoen.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoocaoenoeeb.oosnacoen.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoocaoenoeeb.oosnacoen.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoocaoenoeeb.oosnacoen.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoocaoenoeeb.oosnacoen.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoocaoenoeeb.oosnacoen.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoocaoenoeeb.oosnacoen.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoocaoenoeeb.oosnacoen.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoocaoenoeeb.oosnacoen.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoocaoenoeeb.oosnacoen.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoocaoenoeeb.oosnacoen.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoocaoenoeeb.oosnacoen.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoocaoenoeeb.oosnacoen.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoocaoenoeeb.oosnacoen.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoosaoenoeob.oosnacoen.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoosaoenoeob.oosnacoen.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoosaoenoeob.oosnacoen.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoosaoenoeob.oosnacoen.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoosaoenoeob.oosnacoen.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoosaoenoeob.oosnacoen.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoosaoenoeob.oosnacoen.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoosaoenoeob.oosnacoen.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoosaoenoeob.oosnacoen.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoosaoenoeob.oosnacoen.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoosaoenoeob.oosnacoen.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaiocseooeb.myijaocseeseb.mgjuxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocseooeb.myjaocseeseb.mojnlk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasaccoeasoeneeob.mceosnacoen.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasaccoeasoeneeob.mceosnacoen.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasaccoeasoeneeob.mceosnacoen.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasaccoeasoeneeob.mceosnacoen.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasaccoeasoeneeob.mceosnacoen.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasaccoeasoeneeob.mceosnacoen.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasaccoeasoeneeob.mceosnacoen.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasaccoeasoeneeob.mceosnacoen.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasaccoeasoeneeob.mceosnacoen.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasaccoeasoeneeob.mceosnacoen.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasaccoeasoeneeob.mceosnacoen.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasacoeaeneob.mceosnoen.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasacoeaeneob.mceosnoen.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasacoeaeneob.mceosnoen.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasacoeaeneob.mceosnoen.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasacoeaeneob.mceosnoen.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasacoeaeneob.mceosnoen.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasacoeaeneob.mceosnoen.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasacoeaeneob.mceosnoen.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasacoeaeneob.mceosnoen.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasacoeaeneob.mceosnoen.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasacoeaeneob.mceosnoen.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasacoeaeneob.mceosnoen.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascccoeasoeneoob.mceosnacoen.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascccoeasoeneoob.mceosnacoen.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascccoeasoeneoob.mceosnacoen.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascccoeasoeneoob.mceosnacoen.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascccoeasoeneoob.mceosnacoen.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascccoeasoeneoob.mceosnacoen.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascccoeasoeneoob.mceosnacoen.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascccoeasoeneoob.mceosnacoen.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascccoeasoeneoob.mceosnacoen.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascccoeasoeneoob.mceosnacoen.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascccoeasoeneoob.mceosnacoen.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccoeaeneob.mceosnoen.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccoeaeneob.mceosnoen.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccoeaeneob.mceosnoen.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccoeaeneob.mceosnoen.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccoeaeneob.mceosnoen.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccoeaeneob.mceosnoen.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascseooeb.myejaoseeseb.mstcly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacccieoenscob.ceoscoen.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacccieoenscob.ceoscoen.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacccieoenscob.ceoscoen.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacccieoenscob.ceoscoen.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacecbook.myjacsceoc.xzvych.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacoeacoasenosob.ocsnacoen.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacoeacoasenosob.ocsnacoen.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacoeacoasenosob.ocsnacoen.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacoeacoasenosob.ocsnacoen.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacoeacoasenosob.ocsnacoen.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacoeacoasenosob.ocsnacoen.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacoeacoasenosob.ocsnacoen.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacoeacoasenosob.ocsnacoen.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacsccieasoenoscob.ceosnacoen.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacsccieasoenoscob.ceosnacoen.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacsccieasoenoscob.ceosnacoen.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacsccieasoenoscob.ceosnacoen.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacsccieasoenoscob.ceosnacoen.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacsccieasoenoscob.ceosnacoen.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacsccieasoenoscob.ceosnacoen.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacsccieasoenoscob.ceosnacoen.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacsccieasoenoscob.ceosnacoen.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacsccieasoenoscob.ceosnacoen.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacsccieasoenoscob.ceosnacoen.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacsccieasoenoscob.ceosnacoen.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacsoeacceoasoenosob.oceosnacoen.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacsoeacceoasoenosob.oceosnacoen.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacsoeacceoasoenosob.oceosnacoen.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacsoeacceoasoenosob.oceosnacoen.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.ncbhdjei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.wcloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcascceaoenoob.mceoscoen.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcascceaoenoob.mceoscoen.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcascceaoenoob.mceoscoen.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcascceaoenoob.mceoscoen.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasccsoasoensoaab.ceosnacoen.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasccsoasoensoaab.ceosnacoen.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasccsoasoensoaab.ceosnacoen.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasccsoasoensoaab.ceosnacoen.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasccsoasoensoaab.ceosnacoen.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasccsoasoensoaab.ceosnacoen.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasccsoasoensoaab.ceosnacoen.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasccsoasoensoaab.ceosnacoen.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasccsoasoensoaab.ceosnacoen.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasccsoasoensoaab.ceosnacoen.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasccsoasoensoaab.ceosnacoen.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasccsoasoensoaab.ceosnacoen.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasccsoasoensoaab.ceosnacoen.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasccsoasoensoaab.ceosnacoen.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcascsoaensaab.ceosnoen.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcascsoaensaab.ceosnoen.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcascsoaensaab.ceosnoen.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcascsoaensaab.ceosnoen.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcascsoaensaab.ceosnoen.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcascsoaensaab.ceosnoen.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcascsoaensaab.ceosnoen.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcascsoaensaab.ceosnoen.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcascsoaensaab.ceosnoen.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcascsoaensaab.ceosnoen.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcascsoaensaab.ceosnoen.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcascsoaensaab.ceosnoen.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcascsoaensaab.ceosnoen.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcascsoaensaab.ceosnoen.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.85567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.acloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.mnvhdje.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.pcloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasecceaasoensoob.mceosnacoen.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasecceaasoensoob.mceosnacoen.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasecceaasoensoob.mceosnacoen.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasecceaasoensoob.mceosnacoen.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasecceaasoensoob.mceosnacoen.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasecceaasoensoob.mceosnacoen.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasecceaasoensoob.mceosnacoen.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.31567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.53567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.mnvhdje.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.31567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.gcloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcbeovnvcsowis.oeangsm.mcxugn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcbevssivsvvivcsowis.eazgrsnisgsm.jrvbcm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcbevssvocnvnvcsuvcowisease.oioazrsngsm.gzauog.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacccosoesosob.ceoacoen.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacccosoesosob.ceoacoen.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacccosoesosob.ceoacoen.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacccosoesosob.ceoacoen.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacccosoesosob.ceoacoen.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacccosoesosob.ceoacoen.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacccosoesosob.ceoacoen.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacccosoesosob.ceoacoen.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacccosoesosob.ceoacoen.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacccosoesosob.ceoacoen.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacccosoesosob.ceoacoen.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaccesasoenoasob.ceosnacoen.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaccesasoenoasob.ceosnacoen.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaccesasoenoasob.ceosnacoen.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaccesasoenoasob.ceosnacoen.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaccesasoenoasob.ceosnacoen.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaccesasoenoasob.ceosnacoen.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaccesasoenoasob.ceosnacoen.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaccesasoenoasob.ceosnacoen.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaceascissoenosob.eosnacoen.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaceascissoenosob.eosnacoen.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaceascissoenosob.eosnacoen.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaceascissoenosob.eosnacoen.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaceascissoenosob.eosnacoen.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaceascissoenosob.eosnacoen.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaceascissoenosob.eosnacoen.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaceascissoenosob.eosnacoen.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacesaenosob.ceosnoen.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacesaenosob.ceosnoen.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacesaenosob.ceosnoen.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacesaenosob.ceosnoen.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacesaenosob.ceosnoen.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacesaenosob.ceosnoen.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacesaenosob.ceosnoen.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaeeccasonosob.mcenacoen.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaeeccasonosob.mcenacoen.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaeeccasonosob.mcenacoen.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaeeccasonosob.mcenacoen.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaeeccasonosob.mcenacoen.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaeeccasonosob.mcenacoen.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaeeccasonosob.mcenacoen.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaeeccasonosob.mcenacoen.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaeeccasonosob.mcenacoen.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaeeccasonosob.mcenacoen.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaeeccasonosob.mcenacoen.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaeeccasonosob.mcenacoen.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaeeccasonosob.mcenacoen.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.22567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.53567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.pcloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.wcloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.zeyedada.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.53567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.87567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.85567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.87567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.acloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.ccloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.gcloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.smartlife.plus"; content:"Host"; http_header; classtype:attempted-recon; sid:200010844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.zeyedada.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceascccoiasoensosob.ceosnacoen.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceascccoiasoensosob.ceosnacoen.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceascccoiasoensosob.ceosnacoen.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceascccoiasoensosob.ceosnacoen.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceascccoiasoensosob.ceosnacoen.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceascccoiasoensosob.ceosnacoen.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasceasoccisasoenosob.oceosnacoen.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasceasoccisasoenosob.oceosnacoen.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasceasoccisasoenosob.oceosnacoen.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasceasoccisasoenosob.oceosnacoen.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasceasoccisasoenosob.oceosnacoen.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasceasoccisasoenosob.oceosnacoen.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasceasoccisasoenosob.oceosnacoen.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseeccssasoenosob.mceosnacoen.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseeccssasoenosob.mceosnacoen.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseeccssasoenosob.mceosnacoen.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseeccssasoenosob.mceosnacoen.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseeccssasoenosob.mceosnacoen.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseeccssasoenosob.mceosnacoen.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseeccssasoenosob.mceosnacoen.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseeccssasoenosob.mceosnacoen.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseeccssasoenosob.mceosnacoen.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.22567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.bmhkg09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200010885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.dcloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.jcloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.wcloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjeacsceooesb.moyjeasocseeseb.gzfmft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjeasccseooseb.omyeesjcaoseeseb.gnpais.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjeasccseooseb.omyeesjcaoseeseb.gzfmft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjeeacebcook.myojasccaneo.lozfev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjeeaececbcook.omyjascnacaeoo.orbgrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjeercacecrcbook.moyjacscneocr.iazost.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjeereacebrcook.myojasccaneor.zhyjec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjeeseosiaescrcseocoseebieo.socenmaseocyeueoccesoesjcaoseeseb.ytgs.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.85567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.87567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.mnvhdje.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.22567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.87567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.icfpvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.ncbhdjei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.pcloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.zeyedada.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.22567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.31567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.jcloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.mkma07.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200011070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.ncbhdjei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.ycloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.bcloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.hcloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.nicosia.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.zkzkd04.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200011150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.gcloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.mnvhdje.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.mortys.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.mosjide.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.promotion.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200011184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.qslbjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.wcloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.ahahh04.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200011210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.ahiftgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.aipay.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200011212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.gcloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.22567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.53567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.ahiftgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.ccloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.dwbjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.hafner.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.jcloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.smartlife.plus"; content:"Host"; http_header; classtype:attempted-recon; sid:200011349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.ahahh04.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200011365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.ccloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.31567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.87567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.acloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.dwbjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.mortys.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.promotion.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200011445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.31567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.mkma07.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200011486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.mnvhdje.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.nsuuieds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.wcloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.dcloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.mosjide.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.ocloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.zkzkd04.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200011567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.53567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.87567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.bcloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.hafner.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.mortys.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.wcloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.zhzhh06.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200011621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.22567.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.nsuuieds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.bmhkg09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200011674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.gzfkmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.icfpvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.scloud.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200011741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mykfmxtlop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mykhhorokz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mymklreovz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mymvrnjlty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mynavy-folder-queryculosebrbxworkersdev.culasebrbx.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mynavy-src-resource.routin.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mynbejyrsw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mynditawvj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mynzsjh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myo2-pay.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myoffice365oauth.elementor.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200011780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myoffupvvv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mypayslip.sutherlandglobal.cm"; content:"Host"; http_header; classtype:attempted-recon; sid:200011782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mypenbeauty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myproximus-login.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myreniwn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myretherwallet.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200011786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mysan-review.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200011787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mysan-unauth.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200011788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myshedbuilder.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mytax-form-rebate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mytax-rebate-form.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mytax-refund-claim.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mytheamsauthecent.wapgem.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myujadmpza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myznaphfuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzbxlabomz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzpjrmkmxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzpobxwxsn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzqqyweruy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzrcfihkig.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzrkuzyfxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzsgjjifhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzsucwlbia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzxnvuykbfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzyrznxomh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzyxejmfsz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"n-holdings.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200011807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"n-ver.unaux.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nab-alert.mobi"; content:"Host"; http_header; classtype:attempted-recon; sid:200011809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nab-australia-help.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nab-www.303.si"; content:"Host"; http_header; classtype:attempted-recon; sid:200011811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nacion4lcosrica.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nacionabncrclo.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nacional0998.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nacionalbanco077.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nacionbank908878.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nacionelbaan.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"naciwebder.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nacnuguide.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"naiiorshkb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"naimisharanyatirtha.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"najboljeuslugezavas.betterservicesforyou.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"najowhxnn10010.elysiumga.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"namele.marpuasabentar.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nameless-fog-03c7.dotmay820.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nameless-meadow-0aab.minitab4.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"namelessajaa.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"namelesstr.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"namvgtxkus.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nanazmpekq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nano.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"naoutamateep.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200011832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"napavalleyfinefoods.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"napffx5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"narabeautyusa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nascimentoadvg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nasdaqet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nashakukla.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"naspa-aktualisierung.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nat1onalbr.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nationalbank.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nattynetworks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"naturhouse.sk"; content:"Host"; http_header; classtype:attempted-recon; sid:200011843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nausithoe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navatargroup-auth-0ffice365-folder.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navatargroup-auth-0ffice365-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi10.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi10.uno"; content:"Host"; http_header; classtype:attempted-recon; sid:200011848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi17.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi20.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi30.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi31.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi41.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi51.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi9.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navyfederal-e760.navyfederal432.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navzjbpglq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nayanielectronics.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"naygqsvmcw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nayiiqtkgm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbagjfvksm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbbbjinnhd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbctbxafxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbdypmlqne.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbfhhsdbxcdas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbhabflsra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbhdwpbrfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbiaujowjv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbifbnuwpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbiwjnehdu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nblfkvvdsj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbomejtvft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbsagwbzft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbsumpnbch.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbwcdrzuzs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbwymtrcus.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nby1um.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncbbiyslsv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncbvysfadfdaxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncfyjvesza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncgnhzrzjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nciijnbosg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncityjrwbs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncoafd53cfe55c1019f08c3c010c89f8918efd53cfe55c1019f08c3c010c89f.ncoa-org.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncolaxtsgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncvomgxpjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncvsxncmld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nczfpcqufh.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nczfpcqufh.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nczlitwdbu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndafpnaifa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndahubjgzh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nddvlmxjoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndeflawtechnologies.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndfxhaedwd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndfydlydqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndiwrmsnrm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndkwyskftf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndmhpadsjr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndmozmibkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndpvwygegi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndssgecemn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndtiopjwnz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndtvrxrhet.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndubsrfmaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndwyzypugv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neami.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200011908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"near-wallet-connect-b0f.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"near-wallet-login-hom.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nearprotocol-wallet.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nearwalletgithome.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neat-shade-pantydraco.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200011913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nebqgauahd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"necudneflirty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nedbankqa.flowblocks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nega-access.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nehvieilep.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neixol.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nelmmtjwav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neonamsterdam.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nerdfsbmbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nerestera.onrender.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nerqlkpzxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nervdvrwri.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nesuvicxjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netage.hextra.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200011927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netflfr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netflix-supportauth.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netflixbilling.com-payments.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netflixguiltless-guide.surge.sh"; content:"Host"; http_header; classtype:attempted-recon; sid:200011931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netflixid-film.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netflixid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netinterbank.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200011934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netstation.aplstation-confirm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netstation.netstationinformation.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netwalletauth.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"network360000.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"network360000.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"network360006.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"network360006.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"network360007.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"network360007.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networksolution-validatexl02.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networksolution-validatexl02.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networksolutions-fd.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networksolutions-fd.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday001.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday001.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday0010.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday0010.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday002.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday002.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday003.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday003.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday004.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday004.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday005.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday005.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday006.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday006.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday007.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday007.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday008.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday008.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday009.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday009.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neuxtvckwd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neuzvcefqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neversencommun.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200011970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nevjivelvz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"new-pubg-tournament-pro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"new.hostalmicasitap.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"new.laposadadelch.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"new.mariana-victori.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newadoberound0001.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newadoberound0001.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newadoberound0002.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newadoberound0002.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newadoberound0003.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newadoberound0004.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newadoberound0005.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newadoberound0006.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newadoberound0006.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newadoberound0007.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newadoberound0007.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newadoberound0008.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newfoundationspubl.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newfreedomrealestategroup.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newhopemakassar.co.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200011990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newlink-popup-smart.biglink.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200011991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newmont.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200011992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newpanswap.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"news-room-katolicki.click"; content:"Host"; http_header; classtype:attempted-recon; sid:200011994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newty.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newumd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nex5l-kyaaa-aaaad-qddlq-cai.ic.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nexfzojzwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nexoinmobiliario.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200011999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nextnurzjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neyblqchtz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neyuorofhd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfewpzsppc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfghtjbvxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfilagpmmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfirvrvhto.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nflrogyvjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfntzawqmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfrqnerotx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfrytlphja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfshwoeskg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nftio.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200012012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nftracking.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200012013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nftxvreytw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfuupoepiu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfwtjiqhxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfzzfirusy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ng09vgdp94bihppru9jqc6codldts15bgoogtgnj2lk713g8e88ecq8.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ng1038321ulso2hod9u3tpesjq0idk7l1oocjlj2142otoq4qbctva8.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ng10h9ldc35g1cjr45qv1ouk67qclrsaqu71d9ltm0cnraej76dk2bo.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ng16hqm4qpulo3iophuhm2p82ooonq49hi8umacif3h9g91skg938o0.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ng1am5611e9b3bl0rartq7mca3i0et3ffp37q8t34k0qak4ippai9go.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngadartrhtcvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngaxpjgqsq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngbhbfbiua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngcae.fandoon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngjekglruy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngkcvcmryc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nglvowefpb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngmwsjxaah.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngpvjhrdwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngqxnsamwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngsmartrp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngsovqooar.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngvhjscwma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngxxymycuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngzzcylnnt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhatngusakura.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhattinsteel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhawjkcomd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhdsufarfz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nheclkjeav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhfblsjkyn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhgxhsaiaollshkd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhhklaftkc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhlarqdgpr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhnzxtnsvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhohsiyraa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhomlbgybr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhpdogiawv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhpfkfjnby.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhpqlyntjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhsapply-covid-pass.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhsfdhyubzsxyu.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200012054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhysafodgkho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"niagarapower.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nicephoto.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nicepriceoffice.nl"; content:"Host"; http_header; classtype:attempted-recon; sid:200012058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nicoleaction.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nicoledruschnewitz.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nicoqthehs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nideindia.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200012062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nidmyudaiz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nieuwpoortbe.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nifclgzdzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nighkclick.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nigvbetrty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nikifashion.rs"; content:"Host"; http_header; classtype:attempted-recon; sid:200012068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nikkofarmer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"niohxwmzzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"niqzvcszvt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nirehojmiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nirmdrfcrm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nitro.neeve.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"niupgmlgjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nivudqlqqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"niwa.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200012077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"niywcjwiec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nizotchauffage.bilty.be"; content:"Host"; http_header; classtype:attempted-recon; sid:200012079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njaycqyesg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njdnwlnmnf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njhxgqnjhf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njkyuclrmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njmkweziro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njnsirt3.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200012085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njuocvfzuz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njupjyyoav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njvmrgvdmz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njyeulvnnt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njyrvffjmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njzjtvmzob.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nkcefmntdt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nkhepyzpfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nkhfgcezpg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nkhpledkfn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nkhvmpjtll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nkktvybpfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nklonveefp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nknrvbkhit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nktmkyjwno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nktwefjmva.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlbkyogsrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlcaigigyn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlcfuafzoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nldtjnbvtj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlearjspuv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlicafjyrc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nljgklngmi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlkucqxwle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlnfrzyecf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlnihuumfl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlowlcnkbu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlrlbepoyt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlrxh5.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlstidzuov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nltntyxbkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlttbvqwyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlufhwogjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlvfkyspqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlwsxbshlv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlzyrdgtrq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmadwfpmaw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmcutdiabf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmdqw.oeanymufmdhoy169.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmdsvvifhg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmglgghrjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmhlwsrcjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmiqijndfh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmkdblsfqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmqkzgkcve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmrefrigeration.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmtcqgdjmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmwcokcdva.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmwfehsiaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmwiytkvvm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmxrlclfyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmycyssgiu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmzdlwolfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nna.asiaconnect.bdren.net.bd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nnccv-2qaaa-aaaad-qd4pq-cai.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nnedapgigw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nngerleemt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nniuolcfee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nnklbalqzf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nnnalguyct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nnnhmybrmt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nnqpperhmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nnwzpanwgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nnxgiqoesd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nnyetherwallet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noacollection.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200012151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noawyzhkol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nocnbxtswa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"node6923.myfcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nodemoh-31651.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nodemoh-31651.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noem.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noewwxpfcc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noiseless-summer-softball.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200012159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noisy-arts.03vd9e23.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noisy-shadow-493c.wastrer.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noiufbpjxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nokkectxal.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nokrusrwqy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nolprqjsdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nolzwlgoqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nonprofitnetworkofindia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nopobebqor.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nordaelogg.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nordaelogg.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nordincreading.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"normalangstonrealestate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"northcultitude6263.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"northfacesklep.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nosposte458d.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nossas-solucoes-agora.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notebp004.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notebp004.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notife.help.institutepages.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notification-fb.secure-pages.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notification-page-appeal-19852.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notificationservicefrances.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notificationservicefrances.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notify-me.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200012184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notify-page-appeal-12869281.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notify-page-appeal-12869281.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notify-page-appeal-12962-06889.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notify-page-appeal-12962886-09.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notify-page-appeal-12962886-09.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notify-page-appeal-12986-52552.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nouqfkyfbo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nourayatravel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nouvellefonctionnalitorange.podia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"novidadesespecialdodiaclickcupons.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"novonexcarluize.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nownltrpyu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nownnjahzq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noxtechblob00082310.blob.core.windows.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noxyslqisr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nozkmadynk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"np.bb0n.cheeseconnoisseur.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200012201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"npbxnqqhgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"npcmxzijqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nphgmmxxhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"npiywucfyg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nplnjhjjpj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"npmoqjctqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"npnltsrbtj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"npqkmtjntt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nprczfkyxb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nprgrjlmel.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nprgrjlmel.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"npthvvcips.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nptugnxtra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nptyryzueh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"npvuyiwimg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"npwnlgbebt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqarhudxbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqbftpzlbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqeklzfvwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqeouejdgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqeymzkxnc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqfcqityvq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqgkvyynwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqgzrsvtlr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqhppvxkoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqkgsjgqyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqpmlfyyxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqpvrlefzo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqqpzsxnui.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqrdgnzuda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nquohgafzu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqwshlznoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrddjymwtc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrdznubaqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nredantgst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrekctnckg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrglidwuyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrhnkicnhe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrjdpduaqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrjfewmwql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrkolbtpuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrnhfhzuqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrocaopkqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nroedreamcare.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrsgmsvnfc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrtuel.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200012247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrtxdgnucx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrzlxpxoze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nsamtspoxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nsdfwqrqw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nsjiphrnfi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nsk.russamogon.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nsqmukdhsv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nsqweihnqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nsrbemzsfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nsvsoqvxlo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nt.embluemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nta-aa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nta-ac.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nta-cc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nta-go-japantax-payment.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200012262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nta-go-japantax-payment.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nta-gov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntabprydks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntago-jp.nistkom.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntago-jp.tkgrncb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntago-jp.towakyr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntago-jp.vycvcafl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntago-jp.ypcfwyl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.asdnwp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.cvnuxs.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.czecnbl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.dgrrg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.ehxsrai.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.fatvplv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.hcrkrz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.juhyjkm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.kgfish.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.pafbxco.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.pdxsazf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.qgvvtoq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.ruilibath.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.tifrrqf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.tljkcnk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.txluij.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.uqotjhs.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.uwgoiv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.vbcrck.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.vsdevro.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.wzxiner.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagol-jp.fqicjrw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagol-jp.lsijphlp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagol-jp.mxsjapm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagol-jp.sxfzbuxw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntaguoi-jp.aesfera.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntaguoi-jp.hbslcmu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntamfgwrgz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntekzcwayd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntflx-supression.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntfx-check.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200012301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntjuvkvqjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntkmgekted.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntlago-jp.dhvymbsi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntlago-jp.djchjhje.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntlqtmwaif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntnfpnhvmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntoybgrrmp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntvpwrmmed.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntwks001.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntwks002.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntwks002.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntwks003.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntwks004.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntwks006.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntwks007.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntwks007.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntwks008.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntwks008.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntwks009.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntwks009.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntxojrnywq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nucopqxofk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuevaseguridas.davinuevaportal.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuevo-tuya-2.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200012325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuevoo365tuya.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200012326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuevoo365tuyya14.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200012327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuevosestudi324.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nufveedroo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuhcrlnjnn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuivildreb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"numberoneburger.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200012332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuncorehits.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuotpfgunt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuovaquadrifoglio.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200012335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nupffsogvj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nupsezignu.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nupwniolro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuqdwohtuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nurdedopsa.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuriero.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuuraokhff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuvemdafaturasbrasileira.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuvmhmtmzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvanvlknyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvbhwrlsrr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvdehbstaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvgubyagul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvidia1651665403.zendesk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvigvvjclo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvkwfcxnqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvkxsnqzrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvkydviygs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvojzeomkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvopfminww.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvorppnijy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvqauunrww.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvvnlewalr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvwdqgzcjk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvyscndtcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvyuaibyem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwbolnflqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwcgividup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwdakpzayf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwdqknynum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwhabhnzro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwingufibj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwlfvyjvgx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwmhpbzltz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwnmhqzphe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwnnfmbwpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwrghatt.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwss419.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwsviywnjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwuameiycy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwudyrupff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwvaturwio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwvqwjwipm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwxydnipvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwztzdbgtw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxawvnsjpx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxbczjdlbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxbiboeddt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxbuwwebli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxbvuiajklfaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxdvoounff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxdzplgjed.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxehhtccht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxhcjisc-njkjkjd-jcjkdkjd-9m8wf.ondigitalocean.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxhrgunukr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxiuhemtcp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxjtcpipxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxllmxikla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxlwccmhdy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxnqronbfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxodlufpjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxpdbfdygk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxqntnrkeq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxscysrouc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxuhskdfsdbj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxurbsrarw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxwrezoels.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxycskgvbg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxzfvaxgul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyazniwsvl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyestriasztas.hu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nygchtcfcj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nygxtmqwfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nygxvoixlo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyiksaulekel.66ghz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nykbosoeds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nymo.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200012412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyotisovdu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nypbjekewo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyrzpeeone.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nysestarts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nysethkpd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyupsjxilz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyvlgkznhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nywsenfdov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyxecagasr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyxkkkjjnn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyxxxxyree.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nzbgbhuxzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nzdhwtwzab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nzfhjzmsbd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nzjtrbsthg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nzmzrtpxoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nzritaaext.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nzvqjsigxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nzzjikqmyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"o1x-shipment.5000921.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"o1x-shopinform.0845211.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"o2-account-review.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"o2-account-review.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oabhhawobw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oabpzgfcch.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oafaddowtl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oahyjrxwao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oaipcgmdmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oaipvkflww.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oajehzqhin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oakinnovations-stupendous-site.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200012443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oalcpiolrh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oanafbkajfla.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oancgyhydw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oaoeheklmw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oapcnlgkzr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oapdujqaay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oasisworkz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oasufcquoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oavetjnjrn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oavyaakoyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oaxtydhepn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oayoyteclt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obdfsmvwwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obejdgj20.d208ai8leta6q5.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obfpmevwvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"objective-curie.109-71-253-24.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200012459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"objective-nobel.49-12-243-70.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200012460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"objectstorage.eu-paris-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"objetivacast.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200012462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obllwijbbm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obnmxljmjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obpqwssvay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obramboyob.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"observinglife.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obsiawstdb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obsixmfyql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obtovlwtda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obuvfsfxov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obwcdgbzuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obxgn-wqaaa-aaaad-qczaq-cai.raw.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obxjetflis.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"occcicoop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocdyymmudp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oceelahverifyaccount2022.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocgsqfetkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ochtbpavue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocioturismogalicia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ockkcruugv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocnewyork.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oconace.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocretyhujq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocsclnbflp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocsvsfumvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"octxtzmxmo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocvqnbbcqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocwumxkytp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oczynytsqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odahfzotgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odd-bonus-a725.wastemen.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odd-breadd9a.wed8spk8.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odd-field-9e1d.microsft-docs-foecisayant.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odd-lake-a237.hvac.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odd-wind-9407.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odifghzuxv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odjljnfsuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odnlbltsnx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odoyrkdytm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odszpknloy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odtcnmzoit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odv-shared-file-qs.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odv-shared-file-qs.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odvifzhoml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odwaltqbfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odwgwjjzmi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odxtagpqzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odxzsjxjan.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odzgnjtjbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oea4t2.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oehckibywc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oeitbrhvfw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oejglvyonr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oejrlthnnb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oekovation-ventures.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200012516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oelgfqwruo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oemgmqozty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oemybejnde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oenwtvjseq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oevwjnfnlu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oexwxkabiu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oezozhsozt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofaufqjkzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofdmjtdsro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofdtqeqstu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofekdpnemb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofertamagazin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofewijjjzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"offerbd.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200012530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office-invauth13425.zeknotarzo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office-rsjp2.spheron.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office.ways-status.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office03039200323.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office03039200323.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office18bd41c4e27d01ca654ef485200a641cc381795dd3ee389f34900c690.softmail2.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office24ba15ff9906029c852bb400dea2990b1b8aca4e1b643202d4ec7c0c8.softmais.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office27f227de102c9d63ac9f975899a7eb8727f227de102c9d63ac9f97589.egeary.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office2ba26c936161df9a60ce20211f793266211c4e3be87fdae87bf4d3c4b.softmail3.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office346422eff3a37052e27dceac15b15a1c346422eff3a37052e27dceac1.commercejp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office365-owa1657.microsoftteams.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office365-owa6878.microsoftpublisher.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office365dumc0med5cibcugnc7dkvci2qbmrzo72wkguova62vqkkcib.softmail1.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office39283c79b6d239c952b821624b0e6a26c3383c79b6d239c952b821624.emailnow2.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office517561fc83f1fcba0c373e6a3194623e517561fc83f1fcba0c373e6a3.wheelinghomeless.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office56b37d9abc629a95a353b4753bea37a356b37d9abc629a95a353b4753.acceptance.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office791eb7f904b4cf42b73b8b6eb3bd1023791eb7f904b4cf42b73b8b6eb.tynanlaw.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office7be5d0cc7597185ea2b07c5d67ace2647be5d0cc7597185ea2b07c5d6.mailmicrosoft.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office80f8a649b49eef411c04a82b3e39b85b80f8a649b49eef411c04aa8fd.onedriveoffice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office949abb2585772ab51a8ad332f13989dcd5d5bb2585772ab51a8ad332f.abcsenderz.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office95352e9ccf1b1b0027b683de66e337bb95352e9ccf1b1b0027b683de6.mcrosoftfilezs.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeaf3038133032eec1406a08677e4e3152af3038133032eec1406a08677.mojylaw.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officebd96618918cac08e309d8b2e5a3d6d25bd96618918cac08e309d8b2e5.dreamsgentlemenclub.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officec53d59b9a7fa68faa8ac3e6fed0f7678c53d59b9a7fa68faa8ac3e6fe.cathykonnik.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officedept365cerifi4763.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officedrive204b23499ee682480a9d4fb5592dcf30c7b323499ee682480a9d.ondreivsds.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officedrive671d943c66d43639ff504f6e8603b0d3637b943c66d43639ff50.offices365files.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officedrive6860908c937775e0f58fe179754804126860908c937775e0f58f.onedrivesgf.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officedrivef7848b1089c0b94ba05f0ee7a32b53dbf7848b1089c0b94ba05f.drivecheckmails.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officee421a8bc35722f5aa4bbc277404bf8bee421a8bc35722f5aa4bbc2774.officemicrosofte421a8bc35722f5aa4bbc277404bf8bee421a8bc35722f5a.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeee.bubbleapps.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200012561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officemicrosoft4cc17ac0369d77b37b0126363c5a814f4cc17ac0369d77b3.sharepointsoft.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrive0449c492c4fd1eb2f9a68932d4b8e7ff0449c492c4fd1eb2f.mcrosoftfilez6879.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrive25ffed98fda6dd6c8d5c80834463490d25ffed98fda6dd6c8.microsoftz.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrive634e3a53e73e0036f30a04bf224dcf85634e3a53e73e0036f.microsoft1.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrive7259cb18c1bc44b8e9b415dd251dd4ce7259cb18c1bc44b8e.micromails.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrive7be1bfb0486de510b18632cad5938a287be1bfb0486de510b.paulboffice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrive896f8a9115240dd777b605c925eca22c381c8a9115240dd77.softoffice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrive9cf9dd481ca05e2e7a7837abcf593ef6e37abcf593ef6e37a.mcrosoftfiles.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedriveaf5f5e5ad0794773bb4296155c18d99caf5f5e5ad0794773b.softofficex.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedriveb7affd86aa6565d724aefba4b8dbea52b7affd86aa6565d72.officewi.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrivec34109e8baa4f981ff836aec31d86510c34109e8baa4f981f.softshare.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrivedb4a74607068611f61cd159e966ae78d53c319380101349d0.softmicromail1.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrives2e38ea393a11eb94bd1bc533816b19052e38ea3b19052e38.filemicrosoft1.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonline.manifo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeotani.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeoutlookfdaa672a942961604a8cd3b0cb5247c2fdaa672a942961604a.abcsender.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officequarantineemails.elementor.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200012578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"offices160a0dfe952dc58d52babb813089b049160a0dfe952dc58d52babb81.officemails.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officesc739fc24499a54ef81e2243e9d60c97fc739fc24499a54ef81e2243e.filesesecures.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officialliker.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"offre.streamlink.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200012582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"offyourplate.my.idaptive.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofgcdrpalg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofhcoxfumn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oficialofiice.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofkqcycsli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofnqywwiax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofntddfvvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofomtyeanr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofqpaqwucn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofvur9944.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofvur9944.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofwbqndvyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogbjdaubxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogccgrruxt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogckatgeuq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogczqrlxhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogdraashag.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogezjmdgdi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oggtlmwkkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oghslsqmik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogktmtipie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oglfidgcvr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogmbcwvhvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogmjuyjdst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ognlgamgtt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogoyyburnm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogsnabrmoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogsvjahgye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oguozjqink.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogwnwjhizj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogytfvlokb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogzjresuuq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogzlynledm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oh-viewsharedfile-onedrive.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oh-viewsharedfile-onedrive.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohcjeemsmt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohcloudshare-webmail.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohcloudshare-webmail.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohexntnqkx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohhcxvlhod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohlcvymnvh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohmyglory.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohrvbtelsj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohszl.klaastemedia.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200012626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohuxjzkjeh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohvcxqrzgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohw.tf"; content:"Host"; http_header; classtype:attempted-recon; sid:200012629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohxcwqjwmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oiclgqftho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oigbvdiaku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oihbvsleoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oihgkoligv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oijtgnxjyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oikklpfhie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oikmmmn998.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oikmmmn998.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oiqrsalamq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oisbnjuzhf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oiswwnwsjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oiudpekbpg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oixbfexbkn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oixgiejo8596.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojeymahweo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojfodxtned.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojjcuexose.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojkbnedgsf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojktgghxqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojpdrhipma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojqgjthhoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojrbupbdty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojsipcmxab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojvrvpythd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojyhibtbaw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojyrhvsrft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okanlwzqbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okcphotoboothrental.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okeykknqgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okgojpkmwy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okisokariari.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oklalajjeejeueolikjuensgseamajekeisjdhfhgiakoalo.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oklwzyuqms.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okohdicsji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okplvaeejp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okpwtu.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okrwhiumyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okwinxqgvh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okzuycucoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okzxgpagwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olabert.playcode.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200012671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olaezuvfsy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olaoiqdwcw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olbnrvanbd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olbxvadqzo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"old.martobang.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olgalab.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olgeutavds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olhjotkezm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olipublic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olirecords.mixture.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olivecomposedhypothesis.acessaccount.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olivhtune.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200012683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ollgqgrooh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olllaabekz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olpfknddjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olsapjpiub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oltqvqsjpa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oluwarantinmialafia.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-dispatch.5466475.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-kjjwq.garati.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-kjjwq.gehao.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-kjjwq.marbeh.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200012693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-kjjwq.ramanji.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pl-id95iw.everyones.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pl-my44124.wingflag.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pl-xhp.accept8145.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200012697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.accro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.aeldo.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200012699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.akpool.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200012700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.ampj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.angan.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.armsail.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.bagsterest.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.bittip.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.boshen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.brambu.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200012707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.bxxcs.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.cayin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.cenga.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.cijilu.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.conans.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.cqsfw.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.dantri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.diyang.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.dwane.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200012716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.entame.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.farnlorn.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.fenxin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.garati.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.gdcdn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.giftie.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200012722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.gunwa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.hafusai4.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.inmeng.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.izlet.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.jasonn.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.jiayi.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200012728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.jobsoku.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.kerjaoey.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.kixibyo9.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.kreasi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.ktlxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.lahari.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.larika.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.lentful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.letroc.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200012737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.marbeh.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200012738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.mayoi.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.meijidh1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.mohita.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.mosnn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.muqing.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.nslbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.nzyoga.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200012745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.obras.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200012746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.osbon.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.phunu.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.piaofa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.pqoe.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.purves.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.qihuu.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.rajvic.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.ramanji.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.rdrntwk.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200012755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.remiel.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.rhumpa.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.rizhang.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.sakasa.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.saute.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200012760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.scripter.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.smitraly.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.sousf.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.starpro.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200012764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.tianbei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.tubidye.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.tzdsb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.tzjtzj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.usnorr.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200012769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.vanhien.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.viewsy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.virbuz.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.wdqq.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.wompus.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.xueai.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.yassma.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.yojin.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.ysaksc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.ztosmw.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200012779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.zuojin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx.pikynomyt.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olxform-goods.600761.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olxgzowpqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olxinfo-payment.356457578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olxinform-goods.8099863.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olyqiohwmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olyzjnqprf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"om-9473s.9237-28a.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omahashutters.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omareturnian.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omcfrxiugk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omcpakwfuy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omctkddgco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omdjggeqqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omdqmxltka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omegatourtravels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omerymhldb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omgwmicxpm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omhcdmvwbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omicronhotel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omjtgbtmop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omlbionlsz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omniafricashop.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200012803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omqqqvmwpi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omrgroupitaliagiambelli.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omrgroupitaliagiambelli.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omsunqutpc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omvxgumljj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onamae-vps.mwsdwd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onatfsdlbw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onbrogkyee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ondequiseres.pt"; content:"Host"; http_header; classtype:attempted-recon; sid:200012812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ondrive-58feb.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"one-handed-destinat.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive-98234.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive-98234.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive-file0110.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive-file0110.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive-proposal-96ba6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive-proposal-96ba6.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive-public.fengwind.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive-shared.zineadiet.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.12075354539642.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.ama2on.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.augustus-xue.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.dearkai.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.dpot.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.jennitai.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.nmzl.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.potatoyang246.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.prprv.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.ziznah.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrivee5.joejoe5.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrv-5bbec.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrv-5bbec.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrv.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onee-a0488.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oneone-19cd8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onepovbrpe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onescanner.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onftvqycpc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ongocbwtzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onheqrinkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onige.cm"; content:"Host"; http_header; classtype:attempted-recon; sid:200012844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oniowjzpfx.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oniowjzpfx.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onjikaduaw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onkbpkdfhv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onkcjuqocv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlibanktok.onlibanktok.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online-acount-validat-e.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online-amfc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online-amfc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online-banking-services-dkb.ddns.ms"; content:"Host"; http_header; classtype:attempted-recon; sid:200012854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online-microverifiy.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online-mtb1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online-pdf-portal.visura.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online-soporte.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200012858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online-truist.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online-truist.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online.attservice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online.deny-auth12.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online.jpstrader.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online.sparkasse-de.su"; content:"Host"; http_header; classtype:attempted-recon; sid:200012864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineaccesspoint1.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineaccesspoint2.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineaccesspoint3.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineaccesspoint4.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineaccesspoint5.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinebackinggalicia.bankinggalicia3.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinebank.daviplatasucces.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinebgaliciaar.homebbar.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinecdn3.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinecdn4.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinecdn5.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinecdn7.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinecdn8.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinecdn9.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinedesk1.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinedesk10.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinedesk3.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinedesk4.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinedesk5.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinedesk6.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinedesk7.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinemanage1.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinemanage10.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinemanage2.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinemanage3.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinemanage4.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinemanage5.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinemanage8.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinemanage9.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineoffice365-owa5418.microsoftcertifications2022.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinesantanderspainghgh.com.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinesbanking18279.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineshowerheads.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineteam1.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineteam2.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineteam3.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineteam4.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineteam5.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineteam6.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineteam9.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onnebrzfoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onnetbkhxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onrydgloer.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onspghvdfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onsrfflhdg.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onsrfflhdg.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onstre.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ontarioonlineacademy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onutlummtl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onvcrmoyvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onvfraqumm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onvpkvjgqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onyjqwuoxb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ooaqctwumr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oobchgthrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oocgfcsngv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oofdyrfgwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oogvitxafo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oohlziihch.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oolrddrsry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oonmerdcpc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ooqumyghuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oosiqcxpgj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ootuqpgycg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oouolmtsge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oovzmjofgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oowbyvnshk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oowppzhsen.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ooylargspe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ooymnuxozw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"op-auth1-lk28h.ondigitalocean.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opdalazzam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opdateringsrvc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensea-help.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensea-nft-airdrop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensea-support.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensea-tools.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"openseapro.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"openseaspps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"openseaverification.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensee-marketplace.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensee.nu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"operationiaod892a.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ophnqpeshu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ophyqyhkdj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opirroawsg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opnsea-oo-login.mystrikingly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opntcrfzfl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oponvozihr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opretretopoptk.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opsadnmppb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"optus-support.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"optuselaretanestrace-b94c6f.ingress-comporellon.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200012958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"optusnetcomau-100017.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"optydistribution.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200012960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opvbnuqqdb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opxqsghybs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opzfaggczg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqabanajrx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqbwqlubwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqcvdczaqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqeejmqiuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqffrludsw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqfxbfpfzf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqgbidvxya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqgtqtoglq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqjlpsnlvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqjvwfnvgx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqjzrvcbkq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqobgeaybo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqpfdlvngn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqqptwvggx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqthkslosj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqtoesjlvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqyxhwkaeg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oraanxpouj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orabote.name"; content:"Host"; http_header; classtype:attempted-recon; sid:200012982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orangba116.temp.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orangba117.temp.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orange-france.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orange-security.cloud.coreoz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orange-thunder-1962.anyrag8021015.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orange-verifications.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orange.iobeya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orange.sphinxonline.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orange.windagrande78.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orangebank.mailerpage.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200012992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orangess.contactin.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200012993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oranjempsnspeo.t.justns.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oraqgaezhw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orcube-bf0cf.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"order-variant-kit.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"order-variant-kit.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orderlyvioletdimensions.rastmoonlight.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ordjaqlnkt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ordsenhnyk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orglifrtqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orhncfqosb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oribrdxsbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"origin.axieinfinity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"originmirrors.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orilogbon.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200013007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orionlandscapeco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orjnqddwrr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orllpmmess.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ormail.podia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ormantencs112.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ornima.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orouatwjfi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orpromed.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200013015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orqywmtqnk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orsdhlzmoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ortmyombgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orxbrsjyku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orxoxewymg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orymnwkdwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orzjahghko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orzvqozhft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"osauklxkgh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"osdgkgscmn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"osdugzytzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"osfdsfsdkljk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"osntormzxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"osrtaekocl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ostenergie.osteoenergie.be"; content:"Host"; http_header; classtype:attempted-recon; sid:200013030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otatceensz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otayjhxped.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otbpkxeebm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otehqifohm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otepkvmgom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otgiwdjjuv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"othersplc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"othersplc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otiaysvuwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otibhiycow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otkvzrjkkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otlkihogwo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otomoto-h229.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otomoto3452.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otqvwdqdox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otshfabpgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otshovqnmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otveewhekh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otvqfhxjjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otvtikussf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ou1ook-maile-1d28.queri.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ouczdbimev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ouectnqzeo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ouhcnbfvho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ouikshhavx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oujxkgzlcj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oukeqwlmfb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oumihgebvi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oumjgakjns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oundzmupxz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ouqsntclki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"our-a272e1.ingress-erytho.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200013062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ourkitmrhi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ouruefsabfui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"outlok.formaloo.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"outlook-online-serv.xapori52911831.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"outlook1541489.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"outlookadminsupport.softr.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"outlooksotf_cln_mailcln.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"outlyingfinishedtask.68137098.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ouutjestni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ouvgfaiyar.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ov-h-709f2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ov-h-709f2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovagqsvktt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovbhsvasyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovdjtxhink.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"overdueshyarchives.060300.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovh-cl0ud.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovh-dfh.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovh-link.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovh-link.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovhh-0.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovhh-19f4a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovhirquzxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovifrwcbwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovjnjrqpbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovpnpxoapf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovrjlmtzpt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovsyaibocn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovtkngycyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovtnwjjaaf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovttvyppbj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovvgegdknq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovxjizzivi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovxqvxrqhx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovyhytgvjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owalmrajxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owamail29.auth5656.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owaweb3-6-5.mailauthorize.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owbfymbbxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owgiyfhqgx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owjpdksnqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owkisizhha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owkraaeqtl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owlmxqddru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owlxyhfrpk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owlzelioww.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owrmxwvsuc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owtjynsuaj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owwnzkvzut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owyfdyorvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owyoihaajl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owzqbonlds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owzyydrqmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxbtki.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxdhosjasr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxglfzcalr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxissdvycs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxjiuxqneq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxlavyziia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxmathrpkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxnjiuxqea.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxpizsjjgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxrynfpdei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxsgpxzlnp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxuurvcqxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oyhliofsfx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oyjmjaonho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oykfdmhjei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oylccakybn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oylpaeoxza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oylppbcqso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oynmodheiu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oyonhcirzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oyoshopbuisness.easy.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oytbvxhwoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oyusgvhpeu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oyutwexcfgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oyxpsqsvfm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozabjofcza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozboya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozjlsitcmj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozjwubyiii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozlgnvfpxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozluijatrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozmmjcabiq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozmrimehht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozo.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozsdemdhse.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozuuzldamv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozykbbnzzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"p-stkconn.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200013153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"p0lygon-php.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pa6e55acounsecureapdatesnow11251994.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paatijwamq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pacificcapital.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pack-swiss-post-chf.de.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200013158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"package-redelivery-id901.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"package.drpedrocoelho.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"package2021.blogspot.ba"; content:"Host"; http_header; classtype:attempted-recon; sid:200013161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"package2021.blogspot.bg"; content:"Host"; http_header; classtype:attempted-recon; sid:200013162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"package2021.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"packageservice-address.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"packageusps.cloudns.ph"; content:"Host"; http_header; classtype:attempted-recon; sid:200013165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pag35acountsapdatescecures18293378.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagaesperfectapdatesacoundandsecures.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagamentofaturahiper-a7b8c1.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagaseidntomationsactivitys.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagasidtitysacountidnfomtionsideityts.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page-appeal-form-12865708.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page-appeal-form-12865708.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page-appeal-form-12865798.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page-appeal-form-128761225.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page-appeal-form-128789215.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page-appeal-form-128789215.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page-appeal-form-129876912.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page-appeal-form-129876912.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page-appeal-form-192186921.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page-appeal-form-192186921.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page-appeal-violation-12986962.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page-appeal-violation-29867342.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page-recovery-identity2022.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page.appmobilepages.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page3eprot3ectionsservic3s3curity.epizy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page5comunit1apdatesacoiun1277365.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pageasacounsecureapdatesnow252519972.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pageconfirmation618576.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pageconfirmation652160.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pageconfirmation660003.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pageconfirmation727011.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagehelp-center2022.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200013192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagehelpmail4.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagehelpsupport6516159851.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pageidentity2022.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pageprotection.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagerecoveryidentity2.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pages-help-center.epizy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pages-marvelous-project.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200013199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pages-protection-update-2022.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200013200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pages-protetions-updates2022.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pages.secure-accts.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagesacouandssecureapdatess.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagesecureinf0rmationactivitysystem.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagesecureinformationsactisltysistem.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pageservclnt11.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagesrecureinformationactivltyclients2022.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagessecureinformationrecoveractivity.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagessecuriitiperfectapdatessecurews.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagesupportoffice2022.epizy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pageverictionsidentytysaccountas2022.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagosfreetuya.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200013212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paiementboncoin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paiooetlrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paket-postch.work"; content:"Host"; http_header; classtype:attempted-recon; sid:200013215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paket-secure.us11.instawp.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pakfexunbo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pamanttgff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pamkinbxud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancaekeswap.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200013220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancake-sand.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancake-swapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancake100x.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200013223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancake7wop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakemobile.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakesswaps.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200013226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakesswaps.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200013227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakesvvap.financial"; content:"Host"; http_header; classtype:attempted-recon; sid:200013228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakesvwap.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200013229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswa-p.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswap-home.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200013231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswap.diamondhandsnetwork.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswap.finamce.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswap.himotechglobal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswap.insure"; content:"Host"; http_header; classtype:attempted-recon; sid:200013235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswapapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswape.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswapefinance.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswappers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswappshop.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswapsupport.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswapz.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakesweb.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200013243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancokeswap.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancokeswap.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200013245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancokeswope.finance.mechadda.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pandamoniumplaycentre.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"panelweb-4cae2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pantonecolourss.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paonjrexff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parallelmetaspace.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parametri-di-sicurezza.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200013252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parametriaccessomobile.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parametroaccesso.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parametroverifica.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parcel-reschedule-gb.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parcel-reschedule-gb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parcel-schedule-date.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parcel-schedule-date.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parfumieftin.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"park.great-site.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parkstatesbank.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"particulier-espaceboncoin.18-130-39-138.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200013263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"particulierpaim-boncoin-actif.loseyourip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pasgeasacittycityacaountasmy.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pasgeasidtyisaycomunitytasyasda.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pasgheaastuectonsideytytupdate.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"passgeaccountasdentitytsbverusi.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"passionexploretechnology-busineshlp.my.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200013269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"passionfruit4576261.brizy.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200013270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pataiaalfw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"patient-cell-40f5.updatedlogmylogin.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"patient-recipe-8acc.0z7nntak.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"patient-starp.9u94voh3.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paverguide.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pavivity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paxcxjjler.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paxful-load.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200013278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paxful-term.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200013279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paxful-vendor.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200013280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paxful.com.ph"; content:"Host"; http_header; classtype:attempted-recon; sid:200013281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paxful53.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pay-apple-id.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pay-apple-id.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pay-later-apple.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pay-later-apple.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"payee-review.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"payee-review.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paymentnotificationnow.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paymydoctor.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200013290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"payozavkfq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypal.com.0.security-confirmation.d72b69c8e37aec662e13e39d929d6e3d.as2.2u.se"; content:"Host"; http_header; classtype:attempted-recon; sid:200013292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypal.secure-verimail-usersecure.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay-bank.hjvter.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200013294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.0f8dlc.gdfsgfhcbxcxer.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200013295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.0yfwri.jaofzre.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200013296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.0yfwri.jaojpoa.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200013297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.2nb7zj.jfi8tuyvh.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200013298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.2wui0y.dsxsoiurtd.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200013299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.7u31a6.jaojpoa.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200013300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.con7uq.jaojpoa.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200013301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.hf93yx.jaofzre.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200013302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.i8ck7l.jfi8tuyvh.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200013303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.i8ck7l.sfasfjkxc.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200013304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.i8ck7l.sfasfjkxc.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200013305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.otsdfa.jaojpoa.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200013306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.oy6qg7.dsxsoiurtd.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200013307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.oy6qg7.dsxsoiurtd.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200013308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.x8ftnu.jaofzre.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200013309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.xicdkv.dsxsoiurtd.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200013310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.xicdkv.fsfroqiorx.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200013311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.xzim3p.fsfroqiorx.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200013312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.ye4fd8.dsxsoiurtd.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200013313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.zb0tx3.sfasfjkxc.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200013314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pazngnoquj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pazulxpufq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pazwipjnur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pbenjpbovi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pbihfdblzu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pbiqpauitq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pbjbfqkyzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pbkrbkpbpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pblwptkapf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pboeqobepx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pbojfvrmri.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pbpsnrakoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pbshcxztfp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pbsqkixavn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pbucqirfug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pbwsgcjwgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pbydndxskf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pbzgfttjxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcbtlscpim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pccyjtllme.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcfhuaezoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcfxiakcrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pchmhnopco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pclgidftnl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcliwblgwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcmqcdmmxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcnysciudb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcosniwfml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcsystemscelaya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcvcrutqle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcvmnsxvyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcxpmwdswb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pczajrykas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdairwwvrt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdbkpqtroy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdeaf.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdewnjsxtp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdf-cloud-document.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdf-online-b01bb.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdf-online-b01bb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdf-shared-cloud.project-deec.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdf-sharefile-doc.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdf.file-documents.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdfdocument-24042.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdfdocument-24042.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdfdocument-409d2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdfdocument-67442.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdfdocument-67442.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdfdocument200.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdfdocument200.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdfsecured.mystrikingly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdkarozzul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdmuftxpuv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdnrqpchrm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdnvwkmzdr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdnxidzuwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdojzugitc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdqixpqzen.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdtlhwxpvt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peachyspuffs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peclmjpibu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pederopeder.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pedromaoudmind9.com.ng"; content:"Host"; http_header; classtype:attempted-recon; sid:200013377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peenoquwhz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pegane.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pejcqbqmdk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pejnndknmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pekao.myapp-account.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200013382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pelisquatch.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pemblokiran-fb.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pemlqveqzc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pemulihanresmiakau9.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pending-10.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pending-10.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pending-4b109.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pengembalian-dana.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pepperelmillcampusllc.securevdr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"perfectenergy.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200013392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"perfectliker.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"perfectsacounssuporttandapdates197712.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"performancelocal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"perituza.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"persianmy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"personasportal.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200013398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"personasvietualiempre.virtualsi.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"perspectiveperceptionhypnosis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pestzine.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pettytangiblemenu.homeallstors.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peuamrcwxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peugthgblb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peulpdyckc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pevlibcvmt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peweetools.truly-minting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pewxtgvnub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peyjtkxdzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfazdhprqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfdkqmrbur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfefanwilz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfjykejodq.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfjykejodq.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfkwpyxuvm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfrcpptoaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfvnereorm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfvxjkjjjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfwbiffxph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfxjlkohyc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfyuqxtfxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgcekgsxsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgdswaxm-jp.wpthzht.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200013423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgeesnhyxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgfgtizcqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgfrsmrptu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgfsbulyxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgjmuxmvqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgkoderqfw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgndcrqfuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgobjhbcgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgqbe.myselfy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgqswhsduq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgrggepjyc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgsandrcvryprvcy45744.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgsinfotech.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200013436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgsqummowq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phantom-wailet.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200013438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phantom-wallett.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phantomwalett.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pharmanet.org.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200013441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phcpzkwgyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phhspujrks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phijrsjdfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phjdnoeucj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phleixebxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phola.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"photo.3b9q.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"photostock.uns.ac.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200013449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"php-web-server.02541.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"php-web-server.9524125.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"php5ymysql.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phreshphoto.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phthalocyaninepigement.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phthalocyaninepigement.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phx888.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pianeta-bimbo.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200013457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"piarngttmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pichnckaweb.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200013459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pickjflbed.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"piclfxipzu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"picnic.industries"; content:"Host"; http_header; classtype:attempted-recon; sid:200013462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pict-product.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200013463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pidetuprestamo.stage.analyzenbd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pieuniverse.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pifgovqvwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"piiuujpapy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"piizczyhcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pikay13.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200013469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pilawtyfkb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pilwvywpmh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pinballfinder.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pinjhcjskf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pinkmaids.sg"; content:"Host"; http_header; classtype:attempted-recon; sid:200013474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pinksale-finance.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pipe302414607-ypu6n69k.systeme.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200013476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pipekomjmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pipettemarbling.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"piphipers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pirvnota.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"piscinaveronza.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pisosfarias-0-polygonon-0.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"piurwywdbd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pixoffjphq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjaqgrujvi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjcsifopok.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjepimrilw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjfcfcplsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjhagqvops.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjhoiladkn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjjejovdkj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjnbcdefse.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjpfaclhjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjpziqspxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjsetrkgir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjtififiai.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjtqyntfmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjvpyrphox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjwvmppphz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkbzlqirrj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkckvnwfzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkeqwbyixv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkexlppjie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkguhooste.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkkzklfyqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pklcleelvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkllunnlpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkqqfijosi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkqtwolgwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkrdajhxjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pksjmlcppd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkt-bpsdm.kalbarprov.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200013512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkuswqnbet.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkvfepfsdk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkwucaqoca.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkxgudwpws.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkxycachdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkyopchghe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkypunjqfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkzftrefcl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pl-olx-u28hv2.oferta.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200013521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"placeboook.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"placment.eostudy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plain-flower-e3c0.phantasm0147.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plain-frost-6851.p54drdar.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plain-mouse-6094.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plain.selalusalome.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plamhjhdeg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plamtpwgbj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plasmaticdesign.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plasticaindia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plasticosps.com.ar"; content:"Host"; http_header; classtype:attempted-recon; sid:200013532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"platdujour.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200013533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"play-deikifngsdoms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"playeslgaming.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200013535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"playful-beijinho-647fff.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"playgalagame.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plbanksecurity.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plcdmpntxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plclpxscbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pleasingsaltyblog.sinpup.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plentyofishdating.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plfkgfzktn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plg-polygon-tecnology.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plggozpslh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pllllmzziw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plnnavggku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plnvththsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plnzfowwzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plolollla.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plpaoqvepo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plqeoihgfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plushextralargeparser.bancolom983.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plushperfectaetncionusuario.brouasus.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plxagxsabz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmadkxmtqw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmb.akamigasbalongan.ac.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200013557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmcfmuhojg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmgpbsapvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmkemjwfem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmncgsbnzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmpkxjzdpd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmqknnnpcn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmqurublkf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmqxjqornh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmrplmyhcb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmsauqahjk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmuvoxhjzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmywadqvnw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmzqarkpdf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnajlkklkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnefxisesc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pngdmgyfoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pngnvuoarc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnicoijybk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnjbfvzmsq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnjone.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnjynyfmjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnkcbsbxvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnljteprun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnmkkuskfx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnrcxdewtq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pntojyrlfx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnzzffpsug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pobgshlzvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poc-rewards-program-c2dfc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poconoshotels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poczta-polska.e-kei.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200013588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"podljqnajt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poftrrzsoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pogmotru.flazio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pohsdmkufb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poiseddisloyalwebpage.youtrekkwetr.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poiuylkjhytyu.hgrfedwwddw.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pokajca.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polarinstitute.co.ke"; content:"Host"; http_header; classtype:attempted-recon; sid:200013596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poligrafiapias.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polished-frost-5c8b.pearwormermone.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polished-unit-0189.maddison-383.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polishedvcxvb.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polkabridge-giveaway.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polkadot.network"; content:"Host"; http_header; classtype:attempted-recon; sid:200013602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polkastqrter.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polllygonn-waallet.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pollyggon.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pollygonnwalletconect.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poloskairto.hu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-allegro.id4249854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-allegro.info4661399.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-allegro.merchant1981999.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-allegro.merchant4741605.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-dpd.information970347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-dpd.merchant1981999.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-lnpost.id4249854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-lnpost.information970347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-lnpost.merchant9600973.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-olx.info6769027.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-olx.info6989772.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-olx.merchant9600973.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-poczlta.info6769027.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-poczlta.merchant9600973.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-vinted-hjso21.spturate.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygon---technology.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygon-onlline.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygon-wallet0.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonconnecttwallet.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonexs05.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonixls-antonio.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonixls-leandra.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonjan.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonmac.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonxls-raylson.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonxlss-antonio.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polyqon-technology-connect-wallet.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pooccoin-app.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pooccoin-appa.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200013636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pooccoin-apph.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200013637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pooccoin-appw.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200013638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pooccoin-appy.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200013639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoin-app-plataform-connect.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoin-appf.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200013641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoin-appu.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200013642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoin-appw.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200013643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoin-bsc-charts-token-connect.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoin-connect-app-tokens.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoin-connect-plataform.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoinapp-spwap.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200013647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoinapp-swsap.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200013648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoinapp-sxwap.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200013649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoinaqpp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200013650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoini-appa.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200013651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoini-appn.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200013652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoinsapnp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200013653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoinsapqp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200013654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoinswayp.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200013655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocooin-appd.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200013656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocooin-appr.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200013657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocooin-appz.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200013658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poofsdyhpa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poouqvrnoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"popjoaehdo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"popsystemled.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200013662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"populardclud.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200013663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"popupsubsmart.streamlink.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200013664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poraskjdasfs.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200013665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"porrtalperson.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200013666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portail-client-sfr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portail-maladie.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portal-student-finance.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portal-student-finance.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portal.app.post.it.tyara.sa"; content:"Host"; http_header; classtype:attempted-recon; sid:200013671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portal.bancochile.cl.askinbd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portal.br-gestaos-ltda.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200013673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portal.revenue.sercie.m2xa0.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200013674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portal.revenue.services.m2xa0.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200013675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portal.revenue.services.z4a97.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200013676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalappseguro.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200013677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalbogotaenlinea.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200013678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalclicknegocios.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200013679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portaldosfamosos.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200013680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalebloccadispositivo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portaledigitale.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200013682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalejo.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200013683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalempsweb.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200013684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalenlinea.ampliacion-desolicitud-com.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200013685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalerestrizioni.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalesicurezzablocco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalpayexito.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200013688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portaltransaccionalfalabella.falabellabonus.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portaltransaccionalseguropagos.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portaltranstuyl.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200013691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portaltuyacupo.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200013692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portaltuyapay0.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200013693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portaluyaexito.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200013694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portaluytareaandfdhrth.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalwpsbogota.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200013696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"porwlgjsrr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"posbbanonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poshthirstydimensions.aderlock.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"position-exachange-naps.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"posminterurugiay.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200013701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"post-ch.id1025-pay.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"post-ch.sameday.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200013703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"post-slovenian.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"post.ch-delivery.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200013705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"posta-slovenia.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"posta-slovenia.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postal-sessionbach0025.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postal-sessionbach0025.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postaltrasacionalexito.lovestoblog.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postch.wonstasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postch9192.cargo.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200013712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"posten.no.d2w2e384d9464a1v6644id.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postmailer.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postusercheck.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200013715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"posurzqrxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"potaltyapairinmg.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200013717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pousuittin.mom"; content:"Host"; http_header; classtype:attempted-recon; sid:200013718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"powerbrands.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200013719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"powersafeenergia.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poydiguydo.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pp-90214950.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200013722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppastnveev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppg.unima.ac.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200013724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppgxpadlsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppkdojsxwc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppldpuagkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppljbghkce.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppnsxuuodi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppohnkndyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppooccoin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppoocoih.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppqcemutbl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppqihbfpli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppqjx312j4.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200013735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppsolcsast.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppueawfxpn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppvbixxxbb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppvuyzckct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppxnsxkmjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppzaxspaop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqcocjlxhb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqddogszjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqdoulncii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqenxhvzyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqeuupaowk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqexggtptt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqklweptyg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqlgxompkr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqmmetzvue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqmqnskoht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqnkakqcwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqswjiqglh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqucefhbrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pquuoqabrj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqyimqocjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pr-3.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200013757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pr7k4s.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pra-voce-solucoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prairieharbor.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prbxuvzilj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prcfzbpejp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prcjxet.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prcumqhlcz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"predesigns.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200013765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preg.marketingvici.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prejmwhpyi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"premiaprestamosibk.noustecnologia.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200013768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preoajpmdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preppingconfidence.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prevenstar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preview-content-projet.sugar-voicee.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preview-document.tortesabun.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preview-download-file.dating-optimize.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preview-download-project.voice-chatt.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preview-files.project-deec.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preview-folder.people-media.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prgmd.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"primematic.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200013779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"primeone.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"primeprivatecg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"primex-inter.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prince.ps"; content:"Host"; http_header; classtype:attempted-recon; sid:200013783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"print0ffce.rec6110.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"printingon5th.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"privacy-point-50000245875896309.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200013786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"private-pdf.iteroageme.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"privatkunden-acces.autoescuela-aguilera.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200013788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"privatkunden-acces.starg.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200013789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"privatlogin-customer-acces.autoescuela-aguilera.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200013790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"priyankasandokar1606.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200013791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prizesparty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prizewings.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prmwcqaany.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prmztlgoha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"probblemacc4454.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200013796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"problemspage.ujzo9mpalm-ewx3ldz9k6zq.p.temp-site.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200013797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"procedi-ora2022.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"processbox.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200013799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"procreditecuatorial.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200013800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"procservautomatizacion.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prod-2ht7dc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prod-2ht7dc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"produck-picture-99085.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"produck-picture-99085.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"production.shiny-tree-e80c.clane.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"professhealthproducts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"profiimobiliare.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200013808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"profilaktualisierung-dkb.is-certified.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"programadotz.com.br.admin-mcas-df.ms"; content:"Host"; http_header; classtype:attempted-recon; sid:200013810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"programowanietowyzwanie.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200013811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"progressivebank1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project-checkersfile.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project-cloud-folder.mature-voice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project-cloud-shared.oauthh-conf.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project-folder.chat-securee.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project-list.doceungeyymeu.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project-preview-shared.grand-oauth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project11a-8cd2d.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project11a-8cd2d.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project11c-95a40.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project11c-95a40.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project12c-1ea70.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project12c-1ea70.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project12e-83d13.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project12e-83d13.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project16e-b49de.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project16e-b49de.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project1d-e2a39.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project1d-e2a39.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project4-37fc8.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project4-37fc8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project9c-ed771.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project9c-ed771.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"projectfiles.trainercentral.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"projectjiotower.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"projectjiotower.govermentdot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prolaptop.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prometheus.asia-pancakeswap.dysnix.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"promgalicia.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200013840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"promo.mycorporate-rewards.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"promocionib.machunion.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"promojogopanelas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"proof.mint-live.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200013844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"proojectttt.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"propair.hu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"propercyanwearable.url2132.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"proposal-projects.procesrpguvins.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prosxsiuser.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protect-4d56vca.surge.sh"; content:"Host"; http_header; classtype:attempted-recon; sid:200013850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protect.bartonlewisfamily.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protected-message2022-1311615844.cos.na-ashburn.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protection-32647983222-fb.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200013853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protection-32647983231-fb.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200013854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protection-32647983232-fb.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200013855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protection-46454898944615-fb.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200013856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protection-57489234246-fb.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200013857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protection-57489234247-fb.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200013858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protection-57489234249-fb.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200013859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protection-57489234250-fb.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200013860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protection-57489234261-fb.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200013861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protection-57489234263-fb.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200013862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protection-57489234264-fb.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200013863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"proud-unit-1b37.weatherest.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"proud-wave-c1db.izu0em45.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prpebiyqim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prtqpflmjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prueflowbrooks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pruvecfymu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prwfoyngjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prxpknpbgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"przddqrzet.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psaofrancisco.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200013873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psaoyxunnd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psbpjirlha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pscyaeswyu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psd2-kunde44532.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200013877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psfjmhtixi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psgzwwngwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psmbcatztr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psmupchfux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psosblcvzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psosofxpem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psrdchzovo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pswrvrcrgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pszkclddjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pszkpjtbkf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptbrphrblo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptbwawpzih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptebffgnma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptfyfbjzpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pthfclcdxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptiawgvxtx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptiwsjuhmt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptjkuldijy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptjoxetsar.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptjztysezt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptleslqcwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptlzhxnsig.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptoeteutuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptpjiwuzto.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptpzlzzjrt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptschxjwbc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptszrwqvtl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptuyanewaumentui008t6.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptxx.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200013906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pubblico-servizio-richiesta-sicurezza-digitale.https443.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pubgmidassbuyy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"publicdefinetwork.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"publish-p43452-e180057.adobeaemcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"publishersagency.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pucoatouxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pufrhfkkzr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pufvjccrvm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"puhakro.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200013915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"puhemoabcl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pujabhandar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pukqgmjzxe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pulihkanakunanda22.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pumaperspectives.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"puqzyfowdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"purple-da6462.qqu4qswu.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"purple-morning-d15d.beewatchsea.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"purplebuckets.s3.us-west-1.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"purpttlgmj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"push-spk.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200013926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pushtanaktivierung-sparkasse.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200013927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"puviikhhcn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"puvkjpuydu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"puvtytvvbd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"puxsnicgup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"puyegwgjut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"puylkskifh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"puyqrjsjcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvanlbqcod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvceuqatvj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvdviwfttd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pveqkuyijg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvezkebskh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvfxpysdhu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvgavtrndv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvgxagipih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvkebjxlak.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvlsqcscwy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvoajamvyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvqffimryd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvzdtzxhvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvzmbisevz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwbbssnlaf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwdmyrmduy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwhhtlkvpj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwhrhijjtz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwiuumhwlo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwksjafkrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwkzsbhvqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwnvwaxvxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwobondccc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwrmfkfyjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwtiqapqak.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwudcrpqxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwuqosddwt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwuxriinth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwvqburahd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwvuemzolz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwwhuorgas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwxibqfzbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwychvglae.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxclknigfh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxcpsgsret.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxdcftnujf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxdfvsvwdz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxdsaaqfjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxdyjzkahx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxgqnapzsp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxhjaezdxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxjwbfqmnu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxkwvhklmo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxmobulzsi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxpnvezpja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxqpggkokm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxtiqiivbk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxzlpewzns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pydjfhnxxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pyebrrmgdb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pyepwdlnde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pygyxtfzdb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pyjfqwzpko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pyjpeemdmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pykxgqxghd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pyltcsphzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pymugknruo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pynlmiugyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pynwxamjjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pypfnwcded.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pyrdxgdvzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pyrletfsnx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pysdvpubru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pysnjhmggc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pyudlgksop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pyxegdsxlw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pyxuulkgpf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pyybcnjcdx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzbsssdnml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzdviivacl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzedpfnuzo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzldjobgbk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzrqkkgugz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzslmyyuxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzthsnqoku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzwxkdzygj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzxuyhjujt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzyfevisls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzylvudfav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzzcndpzno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"q64253a68.eservices360.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qaezrcbipm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qanpjlmqae.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qanrflypzc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qaohmzdrfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qapbzosjmr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qasnfiagkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qatar2022.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200014022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qatar2022.work"; content:"Host"; http_header; classtype:attempted-recon; sid:200014023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qautlbkrev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qavtfkawml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qawdvdlzhz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qawlkvfusd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qawxkxrfyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qazxcderfvbgt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbbbfsssst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbdldzugtt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbfianrgao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbftntoajw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbgtgsyqqy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbhhkjfxkf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbhxfirscu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qblwhwapoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbnobmrydm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbocd.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qboxxcehjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbrhmvhakw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbrluqsqjk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbsxwkpqmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbuerqjggg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbvlrqvvrl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbvrbzfgyu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbxoqajhgi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbyiocraiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbymtzmneh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbzwexoddq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcbjhrkaoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcbnyusktd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcbxdzsvlx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcdngqpmnm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcfvreznso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcfyqgojho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qchcljhgdt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qchmyfuvyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcjrtfbujc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qckvpcwohl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qclhcganfm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcmtqfxkww.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcofimcodk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcpboopooo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcrrdqcpoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcrzbsmfdj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcvizcslsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qdbiejelmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qddstiosza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qdnexwsene.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qdxtjrlvrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qeabpirdid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qeaemmgnpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qeapzhrndm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qecstwpwgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qedgfhbdvc.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qediujfpnu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qefjexwnlb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qefwbbrmfc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qeikhtkwtv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qejzjydrcu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qenikeqdjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qernrsllex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qewifilusc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qewitenckg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qeyvnfvrdx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfakchjxoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfepjgtiro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfgtgughqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfmezguedb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfqouhyegp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfrcdbygdo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfryiucwga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfsoptlfoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfvhzkeftx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfvlttipqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfvrworxfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfwqcidida.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfygpkmyvf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfzmsthytr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfzvtrceyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgdsgzeraqfqdfc.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgfystatlz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgkacckmfg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgknrzdezc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgllqksnjb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgnxxojtkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgpgbipeqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgpvlpgtxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgstjxmelu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgxlmimvwy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhcncsmrnf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhiasvmuyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhj39hfxqftr.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhmheewtxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhntfhygrv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhqgrqezzm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhryat.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200014118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhspcdtkju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhuoalxyex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhutszpwyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhvcpuijal.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhwfdgzqdz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhxtdnpzpb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhylauwbeg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qicszsylow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qilfscwjmj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qioxthzjsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qiroslflhu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qirrlvaepz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qismshhkia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qisvwpbdfz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qitltmervt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qivsbzvqlo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qiwq919vamn.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200014135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qiwsrrxdhx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qiwtghcjtn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qixtwjbnqw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qizjyjgmfi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjalonxzal.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjbyvfxlei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjcfohyejp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjfwgvgdmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjghtydzkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjkociodsv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjlidnkuuo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjmlyvrmcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjmsjqqzme.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjnqzxwwnv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjoqngdxbu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjrjqzahsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjsskkonli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjvjchsmsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjzpnkoczm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkatqozxdp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkhzycftta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkmnzgrpgr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkovfqyels.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkplwjecua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkpvniwlcy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkshvbjlkb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkwxobacmj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkxkyhdiiw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkxnopktss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlbljerczd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlgbzbqrbg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlgfveu3.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200014167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlgfveu8.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200014168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlgigitkav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlhapuiaxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlkpzjszvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlmrqkgyfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlpfgunama.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlpfmuvekv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlrizgituk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlrlomwuxv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlsciqtkry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlvgjfewvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmdfpuehpb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmfzirhyqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmgfysdabfdn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmhxohpegb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmncubeqdd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmncxdnpmj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmonwcsqgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmoqtlrfbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmvfokmdny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmvvegzroa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmwwlermzf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmyqjpgpcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmyy6g81shs5mawrnsxfst7benzb8diw7baw2khhduuo7t.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qndcpsbfsx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnddfxjzvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qndzqwkyar.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnelmtodrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnfkitbqqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnhdvuhwrf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnliwcnzkl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnrpacqkiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnsixooupm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnsubmypoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnvjxqwnsv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnwunttxur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnxbazktix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnxypcqzsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnyyjvddzm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnzbhjyonv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qobbcpcqdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qobvzcayls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qoeln.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200014210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qofkcgaewa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qogdgyoxkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qoixcphheq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qopnlqixoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qoqhlmlurj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qoqnmrzfoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qp1ctm.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpaijonanl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpbjjaynqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpcczqutwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpdyskotvm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpihjdcpqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpjaoozhhc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpjxizuuhy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpkjzfpdib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpooocbggg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qppzrhgldd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpqonaxbtn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpssvqlsxe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qqbhrwinrc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qqbuxswkck.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qqcymqbztn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qqjtjzaagj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qqtieovnqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qqxesdwveg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qqzdkzarxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qqzwcjyayf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qr.paps.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200014238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrconnet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrdalyoztx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrdkqrhmux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qresodfgzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrgdbmzprd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrgjofglew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrhrvsdwrf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrlwrrejln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrnhkcewdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrogcluiuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qroztbknel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrsxvrmdws.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrvalvpbse.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrvjxfkcvg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrwhorcfgj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsevumyngz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsfpmzfrrr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsfqpfsbwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsh74pekkv5e8.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qshegon.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200014258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsihlqzppo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsizngcgju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsjxfmhssz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsnmjwdpqc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsnytydlds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qspanlfffl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsrrowrofk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qstivtnmpb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsvk6n.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qswsvfpfnd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsxsscxxoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtbmsprmjn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtcqyxaurb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtgxbrbtqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qthrdxdejh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtlmzgxkxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtoiq4jbdkjlfa.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200014275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtqdkjztxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtrqjousyk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtsfkhndsk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtuyxvfipv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtvaotedfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtwtcljsrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtzhqfcjla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quaflowpvj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quafreefirevip.gearena.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quarantine-2542022app-1311433986.cos.ap-nanjing.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quarantine-mes2742022-1311564033.cos.na-ashburn.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quarantine26042022mic-1311531473.cos.ap-seoul.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quarantine27042022web-1311564033.cos.ap-nanjing.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quarantine29042022app-1311615844.cos.ap-chengdu.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quarantine592022web-1312962597.cos.ap-chongqing.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qube.kz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quchfgkmsx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qucxvnwlde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"query.fanniepace.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quhxhkizhy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quickrectification.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quickwittedheavypress.141330.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quiet-block-e399.westmoons.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quiet-glade-0366.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quiet-meadow.8av37ve6.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quijdforxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quinbyvahe.buzz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quiouyuuu76.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quiouyuuu76.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quitjeohkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quizzical-mcnulty.185-194-219-163.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200014306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qunyyvbsyi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quote123430.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quote123430.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quotee323.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quoter4439000.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quoter4439000.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qupszfzuky.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qutrlkrbgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quulcontke.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quumzqbirn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quuootew32.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quuootew32.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quykayohki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvahhmgrhm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvcasnuffb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvczjbspvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvdntmrymr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvdrftobzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvfnafuskw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvfrnaqdga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvkithzmsg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvlfbhzhjn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvncopzwkf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvpvfcavww.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvuctsifsi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvuspngcwc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvvpwkrxcn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvwmlexydq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvznrxpxxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwaolojawk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwdufpbano.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwemrhgprc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwerrdhzze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwflrruubq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwjjgeijnt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwjvojyyqw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwktaramhd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwooatvhtx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwpwlfhxir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwuzysmkvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwwbvkykkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwwtppdkvm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwxguawwpj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxfsbuzpsq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxhigyjbno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxijwzuonu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxilduujpn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxljrchxsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxlmkebecr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxprhzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxtpdnlejv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxxvrjfvya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxyazjtaii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyamfvhuuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qybrjnwhrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qygevsjaby.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyhmypuxkc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qykziwjrca.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qymvwabwrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyovpfimkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyphmxzbpn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyphpgoezh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyqqnfdllk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyqupdamkw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyqwvqdytd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyulerssbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyuvtluxye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyvuxtqrfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qywdpsatkt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qzihqupfca.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qzlcfxgadc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qzplvilmie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qzsgdfdsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qztoghvmix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qzuxzumapq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"r26ifh.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"r2mzim.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"r8vfisf7v703na8fmxcq.s3.eu-north-1.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"r9ogn4.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ra.kiech.correarealtygroup.cl.#.ahr0chm6ly9iywzrcmvpzjnkzdrwegz0n3hzeg83bxnqedv3axdwamq0zgdmbmxrnxh1advnamezzxdudxrnnghnbs5pcgzzlm5mdhn0b3jhz2uubgluay8jywjvbmlsbgfacmhyaw50zxjuyxrpb25hbc5jb20=3d"; content:"Host"; http_header; classtype:attempted-recon; sid:200014386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raaheudpzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rabbithole.mirror.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rabie-travil-rtack.de.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200014389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"racbmzusqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"racebetter.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200014391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"racing-expo.nl"; content:"Host"; http_header; classtype:attempted-recon; sid:200014392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rack-adminpanel.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rack-adminpanel.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rack-specsadminteam.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rack-specsadminteam.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rackenfordlabs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rackspcemondy004.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rackspcemondy004.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rackspcemondy006.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rackspcemondy006.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rackspcemondy008.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rackspcemondy008.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rackspcemondy009.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rackspcemondy009.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"radhekrishnapackersmovers.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"radhikamd.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200014407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"radiokandela.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"radver.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200014457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200014597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200014736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.131452.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200014830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200014877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rafkonfcxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rafkusmitersa.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200014970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ragezkqpys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raiavqootd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raiutkvlkaen3u1.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200014973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rajasosialmedia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rajirkitermisa.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200015023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200015116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200015163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.vads.fun"; content:"Host"; http_header; classtype:attempted-recon; sid:200015228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200015257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200015304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200015397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200015444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaten-badk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaten-balk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaten-bask.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoesnccsaasecasorsedcceaoo.earescooosearkutsen.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakibmotors.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raktqkrifx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakucojp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakumajp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakuten-co-jp.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200015545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakutencardco.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakuvip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakvten-bask.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ralxkbskvp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ramanjitsingh.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200015550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ranboomerch.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ranniruenx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200015553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200015600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200015693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200015740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200015833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200015880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200015973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200016020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rapid-disk-caef.anyrag8021015.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200016112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rarebli.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rarwakvecj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200016115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200016162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200016255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200016302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200016395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200016442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200016535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200016582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200016675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200016722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200016815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200016862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200016955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200017002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.jianhudong.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200017006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200017096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200017143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200017236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200017283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200017376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200017423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200017516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200017563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200017656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200017703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raspy-king-4ed0.settingspaqesapp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raspy-water-dcc2.beanwoodnode.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rauchenbergerlenggries.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raupnwqbmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rauxumfhwo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ravffbdotd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rawwadqbqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ray-alpha.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200017803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rayalpha.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200017804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rayalpha.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raybanluiza.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raycargo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raydiumprotocol.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200017808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rayhanbusiness.my.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200017809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"razcpufynr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"razq2.bitbucket.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200017811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbcmontgomery.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbdrlsooih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbfcu-2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbfcu-2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbfcu-6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbfcu-9.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbfcu-9.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbfcu-bank6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbfcu-bank6.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbfcu-bank9.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbfcu-bank9.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbfsuphub.servehttp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbfuaccjho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbgogjbaez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbkfytqwfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbmqqbiyhh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbnsgrlaij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbtnr.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200017829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbvwyxphxe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbyomnybxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbyyvjwhkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcacbqnjja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcbcxblmvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rccsufkuxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rceziinrfb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcicpzlbps.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcimxjqvry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcjtcbfbsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rclrkllwkc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcntwfphyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcoghzwdof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcpeqmrokq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcqsdpfnte.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcrlfnciys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcsvzumimd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000001.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000001.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000002.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000002.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000005.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000005.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000006.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000006.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000008.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000008.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000009.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000009.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube111112.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube111112.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube111114.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube111114.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcubebit.bitbucket.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200017863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcuitfqety.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcvixkotlk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcvry.sftyacn.scrthlp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcvry.sprt.acn-cnfrm.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcwcuxpnns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rczbefvnlb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rczbzsvnvh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdcpcihhuh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rde-sharedfile-of.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdfxtjsicx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdhcwcnutp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdhtire.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200017875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdlyau.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200017876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdmytqwnow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdogjgpldt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdoqxszkqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdqqdvvuuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdrtybyfeu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdvtzthrfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"re-redirection-acc-id923872635122.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"re.autecosa.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200017884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"re2ions.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"re2ions.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"re34lhdiv.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200017887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"re7d89uevhusah8c.lavzewwclkpiipe-uiguiui-yutriug.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reactivate-device-au.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reactivate-device-au.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reactivate-device.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reactivate-device.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reactivationoline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reactiwqsdadsd3a.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200017894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"realesign.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"realizacoesefinences.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200017896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"realizerapidaconsultas.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200017897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"realorigin.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rebeccasokol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rece-4a8rgt.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rece-4a8rgt.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"record-cloud-file.product-list.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"records.ozspace.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200017903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"recovery-fb.secure-acct.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"recovery-protection2022.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200017905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"recreatorme.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200017906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"recruiting.rs.ba"; content:"Host"; http_header; classtype:attempted-recon; sid:200017907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rectifydapps.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200017908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"recuperaciondecuenta-12b0.czemarkojo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"red-b90738.ingress-earth.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200017910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"red-cloud-e2f8.ls7lqn9c7536.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redbysfrgroupebox.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200017912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rede-gerenciadorcx-multiassistencia.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redeem-microsoft-code.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200017914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redeliver-parcel-au.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redeliver-parcel-au.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redelivery-elta.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redelivery-elta.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redelivery.gbroyaltracking.20-214-234-184.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redesign.randolphunlimited.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200017920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rediractionid547012016089540218057.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redirecionadordedavipla.informaciondavi.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200017922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redirection-b836d.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redmanphnf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redocean.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200017925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redtailfriday0004.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redtailfriday0004.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redzlseqaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"refund.tax.wvnid.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200017929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reg.tax.s17f.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200017930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reg123r.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regenerations.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regentoption.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regional-ornaments.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regionalezeknozoyda.flazio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"register.animonda.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200017936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"register.templejoy.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200017937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"registerschwein.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reglemenetationsg01.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reglemenetationsg01.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reglementationsg04.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reglementationsg04.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reglementationsg05.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reglementationsg05.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regngfubxe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regoin5.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regoin5.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regularizaautorepuve.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regulation-3002794264711-fb.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200017949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regulation-3002794264712-fb.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200017950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regulation-3002794264713-fb.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200017951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regulation-3002794264714-fb.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200017952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regulation-3002794264715-fb.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200017953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reikiwithasha.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reinforcementdetail.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200017955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reistal-app.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200017956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rejahqyrfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"relaxed-robinson.45-155-168-199.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200017958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"relevantmenacingembeds.daviplataverifi.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200017959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reliancedigitalbootupindia.upflockdigitalconference.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reliancedigitalcompany.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reliancejiojob.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"religia-ksieza.click"; content:"Host"; http_header; classtype:attempted-recon; sid:200017963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rellunotfhx.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200017964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"remixethereumcompiler.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"remototarget.ihostfull.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"remzicakar.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200017967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"renaultbeiro.com.ar"; content:"Host"; http_header; classtype:attempted-recon; sid:200017968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"renkrmxxdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"renner-fatura-boleto.ct37556.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200017970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"renouv-assmaladie.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"renouvellement-aide.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200017972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rent4ever.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200017973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rentapb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rentcozybox.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"renzpanqcu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reowoczgqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"repl-mess.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200017978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reports-package-summary.delivery-ups.com.smksbinaputrajaksel.sch.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200017979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"repspdtijz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reptile-world-nft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"request.br.ironmountain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"requestuspusppepostsrvicesid03912.oznemedya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"required.tbmax.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200017984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rersoahjap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"res-va.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rescheduleandredeliver.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"resect-alert-confrimation-ionos.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200017988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"resolvendo-registro-solucoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"respondwithlife.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"respuestainmediata-parati.ltauenlinea.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200017991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"restles.ndkdjndnnd.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"restless-queen-64bf.dotmay820.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"restrezioneaccessoweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"restrizioneaccedi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"resultado0730.coop"; content:"Host"; http_header; classtype:attempted-recon; sid:200017996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"retaggle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"retired-mistakes-johnny-climb.trycloudflare.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"retiro.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200017999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"retromobilemilano.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"retvwycxds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reuafdhala.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reviewctb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"revisiona-app-bpercard.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"revolut-account-limited.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"revolvingconstantdestination.itau2.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200018006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"revtvxypgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rewardsyncdappssconnect.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rexqeaaqab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rexrxhkgto.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfclarke.ie"; content:"Host"; http_header; classtype:attempted-recon; sid:200018011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfcnhduxcn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfjsjyybpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfnwlkvarg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfoictghuq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfrhuvvxle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfshkmnfpz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfsnpeeetk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfsnycutwy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfvxtydwuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfxkdjiceh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfypwwmvvp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfzachzkur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rg0iq4e8p1mpfc77j66q7pah4tq0h1jmm6rn0mbe1pt3r7g8u9q6ru0.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200018024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rg0jvgaaemu88q9uo7cmjv5chvs8hvtk5sd7nebna7n5snln57tmaeo.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200018025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgbyxxtyob.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgfasdutzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgffdrgfd.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgghhxstgd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rggnpghlgd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rggtondedh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgkjougqaw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgkkvyjzjb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgkyuxvkei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rglhfmvuwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgmzibhqks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgntbgodyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgnxzrosjs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgprsfsvti.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgqhhpwhxz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgsolutions.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200018041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgtuppkakq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rguunimlaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgvfegvre.fewdcewadc.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200018044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgxupptwks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgyzhqnryt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhazaeyjnn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhcxgjgnnw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhglyrmlnx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhkssfntia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhqxlyskrr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhtkvagiqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhuqywzjml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhvmqpbyqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhvvjuwwpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhxxidetxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhykvljkop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ribcrdzhkb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"riconsegnacarta.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ridieyjzeg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rifwtnbwuy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rigdoedosw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"riguizi.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200018063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rigxepeqbr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rigzkquwno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"riivwjpipw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rikdkugmmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rilfruwwwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rilzcmbsck.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rinzvqqwuo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rioivytewj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ripristino-app-bper.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"riraavwybw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"risedefenders.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200018074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"risemedicalmarijuanadisp.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"risersmn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rivalslot388.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200018077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"riveroflife.org.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200018078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"riverviewtire.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"riverwidemusic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rixqtnjqve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjczlzrgtr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjglnraxyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjh788.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200018084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjnnhjlcde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjnztctalb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjrhkvizay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjrktzbtyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjwjvywjkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkcgeizbpu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkdjhpiqnn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkdmxnhxzs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkeinqnwdm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkgroupss.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkhdyezryl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkkchmnerv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkmbjhkczg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkmiipiibo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkosceuebe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkoxxzdgsi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkryblxtum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rksrfzbtgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rktqsqakuq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkuypnvpjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkwkhadxtu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkyyyozrtk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlaxmcwbpf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlcuhrkciy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlduufljmn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rleclomzvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlehwacdjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlgrlfmzdi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlgzbahcoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlhvqzppvm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rljjsebxsi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlkxblyjqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rllfqcoyoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlltjshdyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlmjcofqgf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlogpaduxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlprszpotg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlpwxukgua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlsfojcubw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlwxdpomqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlwyxbxvrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlyyzmxage.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmcdzbzxca.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmcknvmrrl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmcrvprvck.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmdmkluoxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmedvdrtaf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmjasgfqme.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmkhlmiofb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmokvgvgfw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmpnffpuup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmslpftxhb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmtwmxprro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmuaugslsr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmwftwgnad.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmybajdbmn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmzdpjokxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnaceifyov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnaepyeztz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rncfaeiddp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rncjgptgbo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rncresearch.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200018146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rndaaaaaaaa-6e3d1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rndgysnwsx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnglfzksmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnlvqnjrmt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnssrdoptu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnvndbinqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnwfvxahym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnzqdlpheb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ro0vc.app.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200018155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"robertcarlsonlaw.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"robsuninc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roccobonheur1-my-cheetah-website-copy.cheetah.builderall.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rocksageroom.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rockstheme.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rodriguezadams.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rohitsvt.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200018162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rohlricmhy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roisnoob.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200018164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rojfugizra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"romanneluiza.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"romxn96.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200018167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ronhjkngdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ronin-help.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200018169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ronin-wallet.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ronin-wallet.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roninchain.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200018172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roninwallet.cm"; content:"Host"; http_header; classtype:attempted-recon; sid:200018173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ronkalman.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rootscomm.cam"; content:"Host"; http_header; classtype:attempted-recon; sid:200018175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rorgvugqrr.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rorgvugqrr.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roselaka.cloudaccess.host"; content:"Host"; http_header; classtype:attempted-recon; sid:200018178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rosgipysfz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rosshw.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rothschild-ag.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200018181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roudup-60b14.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rough-wood-4310.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200018183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"round-violet-c0fe.henhigay285.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200018184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube-5ae8a.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube-5ae8a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube-brick.surge.sh"; content:"Host"; http_header; classtype:attempted-recon; sid:200018187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube-cpanel-wren.surge.sh"; content:"Host"; http_header; classtype:attempted-recon; sid:200018188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube-production-cf.tx1.mailhostbox.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube-updatealx.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube-updatealx.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube0004.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube0004.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcubemanday001.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcubemanday001.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcubemiinday0005.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcubemiinday0005.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcubmail-authenticat-42a35.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcubmail-authenticat-42a35.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcubmail-authenticatioalx2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcubmail-authenticatioalx2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rouyrckhhq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rovmiglqaw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rovuhomszh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"royal-b930c8.ingress-florina.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200018205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"royal-meat.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"royaleboxm11.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roylnkwzma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rpappsnwbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rpfeiowlfz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rphjvuhqcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rpihwqzzya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rpnsvgesmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rpqreqppce.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rprzdpgtsg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rptpcdshor.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rptrufnpbc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rpyyrcznld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqblrshhvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqegdipqhq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqehnztoyk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqeifgrmfh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqerqfnlss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqezjoojpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqfioyhpqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqgqxstzij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqhrrskmra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqihjanxk34n.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200018228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqksbughpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqkxbbmiwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqqesegstt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqqmlukmgf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqril-ble.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqrimdnrky.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqtxcshlop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqvxzqkhlk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqwjjufltm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqwsiesswf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqwwzuoajg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrbazttuen.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrctfawngq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rregdpnpeh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrhelyzmzf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrhqjplmjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rriwy8.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200018245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrmhcwaefd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrnnjczdco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrogvviwdr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrrrett543.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrrrett543.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrttbghacp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrvgpltfva.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrxscarwcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrzwoyeqbk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rsaliruiht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rshbokilqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rshfwuytrj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rshplgeliq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rskevrdpdn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rspzagqhxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rsqhzsippf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rsweyykggc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rszyminazw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rt6bzz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200018264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtaesnyuta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtbzcjkrvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtdosagvrv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtfklt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtfvpecptl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtgifujjvi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtgkzrpgvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtiibxydwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtjpunsfac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtjvwsyhkt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtkufpnbkc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtnbpfjcms.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtoujypznt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtpebfxozt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtrqft.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtrshoarjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rttgdxcgcgdcd.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rttpwoyyyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtuuaipeqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtwdsnlmjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtxequzrqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtxknqlddf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtzdruljam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtzyvuzmpp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ruacfiyjnr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rucniijinr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rudd-associates.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rudeunsightlyvertexitaupy.itaipy.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200018292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rueckueberweisung.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ruhxsqrioc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ruier.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rujcrdgipg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rulemao.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200018297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rumahair.co.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200018298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ruoqubzzgk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rupiephillips.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ruqflxfqux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"russellpeter.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200018302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rususia.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rutjgfngdd-105846.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200018304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rutjgfngdd.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rutnteawjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ruxoxxnzeh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ruxxskcbuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ruykbmcddm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rvacdnyopj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rvjkongywv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rvldtjiaoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rvnfozksar.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rvnnvxabaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rvqqitezix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rvxtajtrrl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rwbzrgzqzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rwfmsfowdm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rwguxrsxwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rwjudtrnkw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rwmxiicjgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rwpuagzmto.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rwrndxcivz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rwzapelvmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxagljbwxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxdmgxnzgu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxenmtepgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxgvudandh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxklipemdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxkvlqfbxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxonoimjji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxpduqthek.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxqifplbuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxssmglhal.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxtdbzadet.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxuxlpidgv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxvofqqyhf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxzgezfzot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rycejjperf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ryebcysxer.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ryjprnemut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rykbpbqhzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rylqsrpcmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ryrlxcjgls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ryrxzxdypc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rytmhtouyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rywirqzwzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ryzjikrluy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rzckerurbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rzevqljija.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rzfshxobxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rzgeopeqwd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rzgfcagvld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rzkmihxaec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rznbtdbjor.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rzpobeepid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s-fa31f3-i.sgizmo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s-id-pemblokiran-fb-id.webnode.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200018358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s-id-sp.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200018359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s.e-docssig.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s.free.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200018361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s.infidefi-smartsync.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200018362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s.yam.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s104318.gridserver.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s1mple-case.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200018365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s23.proserv.ge"; content:"Host"; http_header; classtype:attempted-recon; sid:200018366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s2yiut.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200018367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s4r9mj97.r.us-east-1.awstrack.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200018368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s5r7pt.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200018369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sa-bb704f.ingress-bonde.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200018370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200018460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200018461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.p8ween.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200018494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200018510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200018534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200018635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200018636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.p8ween.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200018668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200018685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200018709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieccsercsooan.seesaacrcoesniorcnii.ezqrhd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200018811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200018812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.p8ween.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200018844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200018857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200018882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200018982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200018983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.p8ween.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200019017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200019154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200019185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200019322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.p8ween.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200019357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200019395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200019496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.p8ween.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200019529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200019668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200019699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.upfi.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200019728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200019836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200019867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicescecson.seaircarseoini.bsoflw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200019910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200020000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200020001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.p8ween.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200020032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200020047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200020169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200020170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200020202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200020217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200020339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200020340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200020372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200020388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieescecsrono.aseaecsescoconinri.gyzt808.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieescecsrono.aseaecsescoconinri.zjrvox.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieiecseercsooan.seesaccoeosoncnrii.1223478.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieisceecrsoona.seeascscoeoonniri.owekid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieisceecrsoona.seeascscoeoonniri.swixid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieisceecrsoona.seeascscoeoonniri.xubnkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseccsorn.osaeacesseocnionri.ptyslj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200020519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200020520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.p8ween.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200020553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200020568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiscecson.seacarseoini.uvmqsl.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200020599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200020690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200020691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.p8ween.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200020724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200020741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.3nm.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200020777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.wyisqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.xtslink.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200020890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.bwbril.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.wyisqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.3nm.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200021028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.bwbril.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.metatv.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200021086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.wyisqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.wyisqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.wyisqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.3nm.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200021387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.bwbril.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.metatv.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200021684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.wyisqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.wyisqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.xtslink.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200021859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.bwbril.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.wyisqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.xtslink.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200022113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.wyisqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.bwbril.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.metatv.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200022331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.fqcmlink.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200022462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.metatv.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200022500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.xtslink.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200022570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.3nm.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200022759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.fqcmlink.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200022800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.metatv.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200022837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.bwbril.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.xtslink.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200023073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.fqcmlink.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200023302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.metatv.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200023504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.bwbril.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.xtslink.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200023739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.3nm.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200023761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.metatv.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200023836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.xtslink.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200023908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.bwbril.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200024337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200024338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200024370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200024387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.upfi.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200024400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200024509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200024510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.p8ween.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200024542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200024557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.upfi.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200024570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeereiesercscocneom.asoanacaeosoenr.glpzvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200024677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200024678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200024708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200024723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200024840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200024841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200024871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200024887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeisesoccnem.aosoaeosnen.oanbrp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeisesoccnem.aosoaeosnen.pxgpjb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200025009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200025010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.p8ween.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200025042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200025057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200025174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200025175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200025204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200025221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaii0n-limr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200025338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200025339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.p8ween.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200025369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200025384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200025409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisecson.seacseoni.kmpops.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200025416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saapktnnsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200025417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saas-8022d.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200025418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saas-8022d.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200025419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasceecicaaccrirsoonar.seeascacrsooaocaoreosnnaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasceecieaaccrirsoonar.seeascscooooaaoeorsnmaosesonseosiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasceecieaacsrirono.arseaecsescocooaoeosrnmaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasceecieaacsrirono.arseaecsescocooaoeosrnmaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasceecieaacsrirono.arseaecsescocooaoeosrnmaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasceecieaacsrirono.arseaecsescocooaoeosrnmaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasceecisaacnrir.soearacseosniaoeoosnmeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasceecisaacnrir.soearacseosniaoeoosnmeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasciecicaaccrirsoonar.seeascacrsooaeoaoreosnnaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasciecicaacerircsooarn.seesaacrcooaesniraoenosnaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasciecicaacerircsooarn.seesaacrcooaesniraoenosnaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasciecicaacerircsooarn.seesaacrcooaesniraoenosnaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasciecieaaccrirsoonar.seeascscoeooaaoeorsnmaosesonseosiren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saascsecicaacorirn.osareacesseocnaooeosnmraosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saascsecicaacorirn.osareacessoccnaooeosnmraosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saascsecicaacorirn.osareacessoccnaooeosnmraosesonseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saascsecicaacsrirono.arseaecssacroooaaoeorsnmaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saascsecicaacsrirono.arseaecssoconaooeosnrmaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saascsecicaacsrirono.arseaecssoconaooeosnrmaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saascsecicaacsrirono.arseaecssoconaooeosnrmaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saascsecicaacsrirono.arseaecssoconaooeosnrmaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sabadellpagofacil.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200025441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacmhs.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200025442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saddylexou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200025443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sadervoyages.intnet.mu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sadinskoy.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200025445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sadjknyqko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200025446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"safeclientauth.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200025447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"safeopenpattern000123.nighper.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200025448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"safjaufklx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200025449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"safraempresas.com.br.mcas-df.ms"; content:"Host"; http_header; classtype:attempted-recon; sid:200025450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"safty.summarycheck.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200025451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"safuu-launchpad.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200025452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sahleymadison.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200025453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiaaeesccecrsoona.seeascacrsoocninrii.bnmgde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiaaeesccecrsoona.seeascacrsoocninrii.wzsoeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiaieseccesrono.aseaecssoconoinri.bnmgde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiaieseccesrono.aseaecssoconoinri.krgvgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicasioen.a.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicasioen.a.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiccosoiaecsien.oc.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicecsoisisoen.o.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicescsoicssien.o.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200025549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200025550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200025580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200025597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.upfi.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200025610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200025716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200025717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200025748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200025764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saieeresesorccnem.aosoeocansenr.nedltv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saika69sex.monster"; content:"Host"; http_header; classtype:attempted-recon; sid:200025795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saintbarkleyshoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200025796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200025887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200025888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200025919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200025933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisecson.seacsoni.qjpov54.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200025963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saitadobrasil.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200025964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"salamalands.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200025965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"salesdoc.evdpl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200025966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saliksnas.lojaintegrada.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200025967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"salkinafersa.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"salmanfarsi01.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200025969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"salon-eg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200025970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saltonelbluviaggi.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200025971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"salvvrbwib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200025972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"samaelinvestments.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200025973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"samakalinsangbad.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200025974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"samilitaria.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200025975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"samlikanada.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200025976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"samparkinfra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200025977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"samrockchem.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200025978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"samvision.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200025979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"san-dbox-home-lojaprincipessa.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200025980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sandalychacosklep.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200025981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sandeeppk03.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200025982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sandersonphotosonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200025983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sanjilkumar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200025984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sankyo-m.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200025985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sans-cravates.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200025986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"santa565sac.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200025987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"santande40.temp.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200025988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"santander-banc06.es.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200025989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"santyyeyod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200025990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosnifqre.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200025991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saqvididcp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200025992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sarafogliapodologo.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200025993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sarapika.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200025994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaaieeescecscronor.aseaiecsescioconiinrii.bovqgo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaaieseeccsocrn.orsaeaciesseocinionriii.gjedqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaaieseeccsocrn.orsaeaciesseocinionriii.jtpyia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaeiicecseecrson.iseaiorcseoeosninveri.swixid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaeiicecseecrson.iseaiorcseoeosninveri.yfnvfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasfkzezmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasiaaeeescceccrsoorna.seieascacirsoocininriii.sjmogv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasiaaeseecccscronor.aseaiecssacirooniinirii.jnklqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasiaeeseeccsocrn.orsaeaciessoccinionriii.6366778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasiaeeseeccsocrn.orsaeaciessoccinionriii.ptyslj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasiaeeseeccsocrn.orsaeaciessoccinionriii.yfnvfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasiaieeesceeccrsoorna.seieascsciooocninirii.cpgspk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasiaieeesceeccrsoorna.seieascsciooocninirii.mylnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasiaieseeccescronor.aseaiecssocionoinirii.evyqhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasiaseeeccsoncr.soreaacsieosnicionriii.fbgnzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasieaececscecrson.iseaiorcaersoscininveri.kddqct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasieascececcsron.sieaciorsaeronsiinveri.zcwxrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sassaeaiececsccecrsron.isieaiorciaerseisoiniinveri.onveal.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sassaeisecececcsornr.seiaicsioreioenisinverii.ojvntr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sassieesecececcsornr.seiaicsioroicenisinverii.gyzt808.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sassieesecececcsornr.seiaicsioroicenisinverii.mylnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sassieesecececcsornr.seiaicsioroicenisinverii.sjmogv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sassieisecececcesrorn.sieiaciorsioeoniisnverii.xjyfjd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sassieseececcsconr.rseaicisoiorniiesnvierii.3354788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sassieseececcsconr.rseaicisoiorniiesnvierii.osqsyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sassieseececcsconr.rseaicisoiorniiesnvierii.owekid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"satanoxz.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"satay-secur.reconfimations.pagedisabled.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sauinwnfid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"savingsfordentalcare.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"savvycraftymom.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbamfvcypc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbaryptwgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbaubjhyak.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbaubjhyak.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200026029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbcglobalmailnotifications.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200026030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbcnicpdrd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbdxxczsjb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sberbank.id4541.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200026033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbfastfood.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbgaytzdjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbhdvnkovt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbhkrhkgzh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbioafdkfh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbjuoftzjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbkloleoic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbndjurxjk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbneefnwbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbopueqsop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbpnqegnlq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbrkhsraio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbs-siebanlagen.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200026046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbujamdpof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbuwbutmbk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sc-01111000.ihostfull.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sc.apartmentbardolino.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200026050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scacsoieisasono.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scacsoieisasono.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scanoffice365-owa4874.microsoft365scan.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scapes01.bitbucket.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200026054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scaseeissason.a.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scaseeissason.a.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scaseoecsoeissason.oc.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sccaxgbadr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scdvmzuojw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sceiplc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sceniccable.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scesdjxfth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scgengemlv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"schbh.chenkaicpa.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200026064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"schmittner.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200026065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"school.greenislandtrust.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"schryoebfy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"schyoubyap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sclswisscom.flazio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scmbxlfiuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sco1992999.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200026071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scooterx.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scotiabankcolpatria.colpatriaas.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200026073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scotiapersonasp.scotiapersonasp.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200026074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scratched-silly-manx.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200026075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scrsalprsonvrtual.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scrty.cold-thunder-d531.siteacn.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scruty-80000035698698745201.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200026078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scsltwuidb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scubadiving.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200026080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scwvcvpkbl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scxpaczbms.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sczomcexas.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200026083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdbf.sk3f5ju.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200026084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdbgbknjlm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdffgg.vgyn1m.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200026086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdgh765.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200026087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdgvsdvsdvs.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdhekaehkn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdiqvhqpam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdsgf.0qxnt4u.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200026091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdsmggsrwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdswdat.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200026093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdwjjifexs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdyqekgkbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seabnb.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200026096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seabreezehosting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.5sime.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.com-deals.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.ioxsho.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.ladyul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.qskgtg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.u25r5u.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.upjhye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.wwffoj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200026120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.457e0p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.5uzz0h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.gjglse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.klgmfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.notwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.rgdpsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.rzuxzq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.uhia8h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.7hml9e.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.chkmuq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.hycxop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.mbirgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.notwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.hycxop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.invpbv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.klgmfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.lgwjlm.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.nrmzy6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.qvcxln.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.saveyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.6mmfl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.ihfo5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.ladyul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.wl85i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.3p1yb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.com-deals.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.rn5mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.awsgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.b4eqf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.bs7dc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.mwdrbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.nrmzy6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.qskgtg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.rjbvwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.5sime.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.chashanchu21.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.ehgmml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.n21so.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.notwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.6mmfl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.b6x80w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.fahxqk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.nrmzy6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.3p1yb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.650pt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.b4eqf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.chkmuq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.flscly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.lgwjlm.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.rjbvwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.shanchuta27.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.u25r5u.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.upjhye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.457e0p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.7ngywp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.bs7dc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.l4p2g1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.nrmzy6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.patcfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.wolvps.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.l4p2g1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.ofldnb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.shanchuta27.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.4i3si1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.doenfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.iytxjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.kpgvbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.650pt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.ehgmml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.hyhznq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.notwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.patcfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.ph29h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.ptrwmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.457e0p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.7ngywp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.mbirgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.nr5kfh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.qfvbqx.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.royjjy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.rzuxzq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.7lnki4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.7ngywp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.gs3do.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.invpbv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.ladyul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.saveyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.wolvps.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.6mmfl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.7ngywp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.9v9w2y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.dnmsu6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.pjt9os.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.tilzhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.u25r5u.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.3p1yb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.7ngywp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.8fgrh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.bbl7ef.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.fahxqk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.lgwjlm.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.nr5kfh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.vcgsip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.5uzz0h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.7lnki4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.fahxqk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.invpbv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.qskgtg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.upjhye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.457e0p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.invpbv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.ioxsho.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.n6eonm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.rzuxzq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.tilzhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.vfqske.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.vkpock.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.7hml9e.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.awsgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.gs3do.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.ihfo5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.qskgtg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.wwffoj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.ehgmml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.invpbv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.iytxjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.l4p2g1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.mwdrbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.rgdpsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.chkmuq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.gamxhl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.kpgvbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.ladyul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.tbntv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.7hml9e.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.8fgrh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.b4eqf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.ehgmml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.gjglse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.gs3do.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.ihfo5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.iytxjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.shanchuta27.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seafooddeliveryapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seal-app-k2wcm.ondigitalocean.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200026643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.3dbbmp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.6mmfl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.7hml9e.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.7lnki4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.7ngywp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.8fgrh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.9v9w2y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.b32mgr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.b4eqf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.b6x80w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.bs7dc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.chashanchu21.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.chashanchu48.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.contius.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.cstztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.dnmsu6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.ehgmml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.gamxhl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.gs3do.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.hycxop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.hyhznq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.ioxsho.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.iytxjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.kpgvbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.ladyul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.lgwjlm.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.mbirgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.mwdrbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.n6eonm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.nfpdgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.ofldnb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.ph29h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.ptrwmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.qfvbqx.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.qskgtg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.rgdpsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.runjin007.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.rzuxzq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.saveyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.u25r5u.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.upjhye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.vkpock.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.wwffoj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200026773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.2sae6k.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.7lnki4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.8fgrh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.awsgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.b32mgr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.chkmuq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.cqvlsi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.cstztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.gs3do.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.hycxop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.invpbv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.ioxsho.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.iytxjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.klgmfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.n21so.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.n6eonm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.nfpdgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.nrmzy6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.ofldnb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.ogzbtb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.patcfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.pjt9os.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.qfvbqx.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.qvcxln.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.rjbvwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.royjjy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.rzuxzq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.saveyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.shanchuta27.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.uhia8h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.vcgsip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.wwffoj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200026907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.3dbbmp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.3p1yb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.4i3si1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.5sime.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.5uzz0h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.awsgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.b32mgr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.b4eqf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.b6x80w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.chkmuq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.com-deals.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.fahxqk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.gamxhl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.hycxop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.hyhznq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.invpbv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.klgmfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.lgwjlm.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.mbirgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.mwdrbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.n21so.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.n6eonm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.nrmzy6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.ogzbtb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.patcfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.ph29h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.pjt9os.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.qskgtg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.qvcxln.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.rgdpsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.rjbvwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.rn5mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.runjin007.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.saveyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.shanchuta27.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.tilzhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.u25r5u.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.uhia8h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.upjhye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.wl85i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.wwffoj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200027050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.3p1yb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.4i3si1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.6mmfl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.7hml9e.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.7lnki4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.awsgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.b4eqf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.b6x80w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.bs7dc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.chashanchu21.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.chashanchu48.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.com-deals.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.cstztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.ehgmml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.flscly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.gamxhl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.gjglse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.gs3do.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.hycxop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.hyhznq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.invpbv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.ioxsho.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.kpgvbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.kuaiweichongwu14.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.l4p2g1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.ladyul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.lgwjlm.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.mwdrbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.n21so.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.n6eonm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.notwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.nr5kfh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.nrmzy6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.ofldnb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.ogzbtb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.patcfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.ph29h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.pjt9os.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.puoo9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.qskgtg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.qvcxln.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.rgdpsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.rjbvwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.royjjy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.shanchuta27.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.tilzhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.u25r5u.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.uhia8h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.upjhye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.vcgsip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.vkpock.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.wl85i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.wolvps.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200027203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.457e0p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.5uzz0h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.7hml9e.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.7ngywp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.8fgrh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.9v9w2y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.awsgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.chashanchu48.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.chkmuq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.dnmsu6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.doenfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.ehgmml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.fahxqk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.flscly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.gjglse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.gs3do.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.hycxop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.ihfo5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.invpbv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.ioxsho.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.iytxjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.klgmfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.kpgvbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.l4p2g1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.lgwjlm.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.nr5kfh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.nrmzy6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.ofldnb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.ogzbtb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.ph29h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.ptrwmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.rjbvwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.runjin007.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.saveyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.tilzhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.vfqske.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200027340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.2sae6k.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.3dbbmp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.3p1yb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.457e0p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.4i3si1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.5sime.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.7lnki4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.chashanchu21.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.chkmuq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.com-deals.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.contius.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.cqvlsi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.cstztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.doenfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.flscly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.gamxhl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.gjglse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.hycxop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.iytxjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.kpgvbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.kuaiweichongwu14.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.mwdrbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.notwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.ofldnb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.ogzbtb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.patcfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.ph29h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.puoo9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.qskgtg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.qvcxln.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.rgdpsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.rjbvwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.rn5mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.royjjy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.runjin007.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.rzuxzq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.u25r5u.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.uhia8h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.vkpock.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200027477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.2sae6k.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.3p1yb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.457e0p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.4i3si1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.7hml9e.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.7lnki4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.9v9w2y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.bbl7ef.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.cqvlsi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.flscly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.gamxhl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.ioxsho.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.iytxjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.kpgvbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.kuaiweichongwu14.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.l4p2g1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.mwdrbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.n21so.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.n6eonm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.nfpdgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.notwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.nr5kfh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.ogzbtb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.ph29h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.pjt9os.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.puoo9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.qskgtg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.qvcxln.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.rgdpsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.rn5mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.royjjy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.runjin007.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.saveyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.tilzhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.upjhye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.vfqske.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.wl85i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.wwffoj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200027617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.3p1yb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.457e0p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.4i3si1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.5uzz0h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.7hml9e.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.8fgrh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.9v9w2y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.awsgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.b6x80w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.bbl7ef.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.chashanchu21.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.chashanchu48.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.flscly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.hyhznq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.ihfo5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.invpbv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.ioxsho.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.iytxjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.klgmfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.kuaiweichongwu14.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.mbirgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.mwdrbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.nrmzy6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.ofldnb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.ogzbtb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.patcfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.ptrwmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.qfvbqx.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.qskgtg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.rgdpsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.rjbvwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.royjjy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.runjin007.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.rzuxzq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.shanchuta27.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.tilzhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.u25r5u.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.vcgsip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.vfqske.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.wl85i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.wwffoj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200027757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.2sae6k.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.3dbbmp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.457e0p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.6mmfl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.7hml9e.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.7ngywp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.9v9w2y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.awsgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.b32mgr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.chashanchu21.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.chashanchu48.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.cqvlsi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.cstztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.dnmsu6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.doenfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.ehgmml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.fahxqk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.gamxhl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.gs3do.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.hycxop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.hyhznq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.invpbv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.iytxjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.ladyul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.lgwjlm.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.mbirgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.mwdrbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.n21so.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.n6eonm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.nfpdgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.notwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.nrmzy6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.ofldnb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.ogzbtb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.pjt9os.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.puoo9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.qfvbqx.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.qskgtg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.runjin007.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.rzuxzq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.saveyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.tbntv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.tilzhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.uhia8h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.vcgsip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.vkpock.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.wl85i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200027903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.3p1yb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.457e0p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.5sime.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.5uzz0h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.650pt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.7ngywp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.chashanchu21.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.chashanchu48.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.com-deals.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.contius.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.cstztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.doenfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.ehgmml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.gamxhl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.gs3do.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.hyhznq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.ihfo5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.invpbv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.ioxsho.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.iytxjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.klgmfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.kpgvbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.l4p2g1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.ladyul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.mbirgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.n6eonm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.nfpdgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.nr5kfh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.ph29h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.ptrwmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.qskgtg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.rjbvwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.rn5mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.royjjy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200028029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.runjin007.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.rzuxzq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200028032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.tbntv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.tilzhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.u25r5u.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.upjhye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.vfqske.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200028043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.wwffoj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200028048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200028050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.2sae6k.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.3dbbmp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.5sime.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.650pt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.6mmfl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.7hml9e.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.awsgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.b32mgr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.b4eqf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.bs7dc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.chashanchu21.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200028087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.contius.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200028090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.cqvlsi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.cstztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.doenfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.fahxqk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200028106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.gamxhl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200028111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.gjglse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200028113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.ihfo5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.invpbv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.ioxsho.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200028128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.klgmfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.mbirgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.mwdrbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.nfpdgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.patcfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.pjt9os.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.qfvbqx.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200028158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.qvcxln.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200028161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.rgdpsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.rjbvwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.runjin007.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.shanchuta27.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200028169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.wolvps.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200028170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.wwffoj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200028171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200028173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.650pt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.6mmfl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.7ngywp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.9v9w2y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.chkmuq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200028195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.contius.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200028197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.cstztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.doenfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.gamxhl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200028208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.klgmfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.n21so.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.n6eonm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.nfpdgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.nr5kfh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.ofldnb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200028237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.ogzbtb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.ph29h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.ptrwmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.puoo9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.tbntv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.tilzhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.wl85i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.wolvps.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200028260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200028262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"season15.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sebat-dhl.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sebene27.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200028274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sec-veri-citizens.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secauchhssservice.rtcgroupholdings.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secittystrisaccountsifnesotyss.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secretsforsoldexpiredhomes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securdroyalcreditun1on.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-alpha-497da0be515757web.gidiagents.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-dashlane.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-document-project.ereoveisnot.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-iccu2web1.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-login-dkb.ddns.ms"; content:"Host"; http_header; classtype:attempted-recon; sid:200028284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-reconnect.dinamic-ourtime.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-runescape.xgm.rnp.mybluehost.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200028286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-servicepublic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-sligth-document.ertoolfo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure.oldschool.com-o.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure.oldschool.com-rs.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure.oldschool.com-t.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure.oldschool.com-v.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure.runescope.com-as.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure.staman.direct.quickconnect.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200028294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure02-ustrack-nship-uservices.codeanyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure03a-chase6b.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200028296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure2-sfr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure296.inmotionhosting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure55.webhostinghub.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure6y-commonwealth.4nmn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secureaccountsavedlogin4665695955.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secureaccountsavedlogin545856656.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securealert.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secureappbtbusiness.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200028304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securecuserver.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secured-message.outlook10.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secured-message1.outlook10.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securedprotocol.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securefacebook.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securefile.jennitai.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secureloginupdateinformation56652654215642.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secureofficefaxmailportal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securepayeeremoval.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securewebapps.wonstasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-1000000006983265874926859836593.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-1000000006983265874926859836594.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-1000000006983265874926859836598.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-6000000659846985642369874659461.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-6000000659846985642369874659463.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-6000000659846985642369874659466.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-6000000659846985642369874659469.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-80000025897465325984698466980.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-80000025897465325984698466983.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-80000025897465325984698466985.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-80000025897465325984698466987.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-admadsdasin.yourtrap.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-adminasa.onedumb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-100000002589876345698592.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-100000002589876345698594.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-100000002589876345698596.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-100000002589876345698599.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-100000006973265984695360.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-100000006973265984695361.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-100000006973265984695362.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-100000006973265984695363.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-100000006973265984695364.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-100000006973265984695365.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-30000000025643986592610.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-30000000025643986592611.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-30000000025643986592612.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-30000000025643986592616.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-30000000025643986592617.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-800000002563986495629850.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-800000002563986495629855.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-800000002563986495629856.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-800000002563986495629857.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-800000002563986495629858.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-page-community-standards.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security1gateway1outlook.confirmacion001.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securityaccountprotection32564.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200028350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securityexit.260mb.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sedekahchip1-5b.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"see-me-c1c3f.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"see-me-c1c3f.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"see-my-blog.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seehere.trainercentral.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seg39.lic133.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"segubisa.0hi.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200028358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"segunda-serve.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"segunda-total-hiper.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"segundavlahiper.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguridad.itauwebpy.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguridad02662.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguridad0662.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguridad902290.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguridad904490.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguridad9097.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguroitservices.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguronacionalcr.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200028369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguropagoapp.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200028370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"segurosernestovillarreal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"segvxd.j40nf89.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200028372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sehdnszizo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sehrgeehrterprofilaktualisierung.geekymind.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200028374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seipl.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seiyxykjun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sejsloao6181.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sejundlbqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"selecciondeempleocr.webnode.cr"; content:"Host"; http_header; classtype:attempted-recon; sid:200028379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seleccionesuplataformaelectronicascgr.webnode.cr"; content:"Host"; http_header; classtype:attempted-recon; sid:200028380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"selfreplicatingsoftware.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"selmomntinga.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"semanario7dias.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sempremelhor.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"semt.futminna.edu.ng"; content:"Host"; http_header; classtype:attempted-recon; sid:200028385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"semtmdetpr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendungsnachverfolgung6-chpost.work"; content:"Host"; http_header; classtype:attempted-recon; sid:200028387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"senhbhlhku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"senscommunication.mjm.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200028389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sensdapps.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sensdapps.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sentander.com.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200028392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seobywebitindia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seoservicesiox.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seoservicesiox.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sep2020.sarsk.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seqdqdukxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serch26.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serfrtgtgrf.byethost9.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serpienteonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sertel.com.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200028401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sertyxese.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serv5.servs.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"server-11-collab.land"; content:"Host"; http_header; classtype:attempted-recon; sid:200028404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"server-4-collab.land"; content:"Host"; http_header; classtype:attempted-recon; sid:200028405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"server-7-collab.land"; content:"Host"; http_header; classtype:attempted-recon; sid:200028406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"server-data-20d8d.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"server-data-20d8d.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"server-dxths3.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200028409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"server-goeif4.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"server-networksolutions.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servertechnicalnoticeimmestae-reconecting.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servic-4096.awuqohsjo9847.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"service-assurance-maladie.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"service-microsoft250.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"service-online.world29892893vhost246833.lowhost.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200028416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"service-publique-gouv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"service.runescape.com.os-rs.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200028418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serviceadhelpmeta.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serviceadhelpmeta.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicecheckupaccounted.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicecompte.myvnc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicedoc001.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicefbhelpmeta.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicefbhelpmeta.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicegeneralprotezione.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicemms.weezbe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicepage.service-page.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicepublics.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200028429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"services-enligne-web-ba84b3.ingress-bonde.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200028430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"services-lnfoguide.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200028431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"services.oldschool.com-as.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicesbancaire.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicioalclientebn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicodevalidacion.revisar.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servics.validationsecuradm.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servisaludec.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servizio-spedizioni-bp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servmailclient5.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sesmbtazwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sespjkoodm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"setcezwept.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"setda.tabalongkab.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200028443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"setupmynorton.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200028444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"setupyouraccounts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seu-dia-quitado.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seul.unilurio.ac.mz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sevenlee-it-solutions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sevenmaxguns.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sewkmyjotq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sexibjesfb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sexytitty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seyyvhnlsv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sezionecarte.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sezxywtemf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sf.eclafvg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200028456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfb.cfkreer.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200028457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfbjtdbnhx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfc.com.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200028459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfdgteuyqaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sferaitalia.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sffxwszcaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfgevjpdhy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfghdgheda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfghvn.55bfqx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200028465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfgxtdutzh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfhvzxbdfi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfirstrepublic.coms.cso.gov.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200028468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfmkacomvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfnlcptpkc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfoluamyhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfqkscznwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfqoacmzjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfqqtprpmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfr-abonnement.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfr-contact.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200028476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfr-forfait.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200028477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfr-telephone.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200028478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfr.espace-verification.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfrpanel.lws.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200028480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfrsupport.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200028481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfsampcacd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfsssffxwy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfxxsozfbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sg-dbs-paynow.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgiaeyfnse.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgixkngaly.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgljszogke.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sglpultbxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgoouauqnf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgp1.vultrobjects.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgpfsyavsz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgqlghhemi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgrvanpwkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgsgtshpvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgtbalde991-dot-still-dynamics-321006.ue.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgumshcucl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgupitdlum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgxjagmqya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgxr.zwrq1tu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200028500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgzqumdtut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sh.mfuture.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shabbyunrealisticcharacterset.andryvivas.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shahjis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shakibaart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shampinplasteikncs.shampinplataaa.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shampinplatsada.wqrwqrwqrwetqe.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shanky0.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200028508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"share-eu1.hsforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"share-file-drive-device-local-disk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"share-file-drive-device-local-disk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"share-file-login-pdf.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"share-file-view-folder.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"share.ebforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shared-cloud-preview.post-confirmation.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shared-cloud-project.reading-voicee.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shared-email-files.documents-project.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shared-files.messseg.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shared-folder-private.nhilenhil.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shared-private.files-auuth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharedfax815201376.wordpress.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharedpointonlineauthentication.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharefile.prep.kaudiaestate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharepoint-f0e5f5-8c91-49fc-af1f-cb56b5f54a61.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharepoint.hi-old.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharepoint.timelessincome.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharepointle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shareporintttkrjt.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shbluwjfqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shedaovacc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shee35.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shein-com.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shein-us.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shein.ooc2.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sheinimporter.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sheinpromo.company.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200028536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sheinsize.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shiasdubuad.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shibas-wap-app-mobille.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shibasllwapi.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shibaswap.mypixieset.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shibaswapasd.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shikimei.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200028543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shiny-sound-a24a.rcvrysrvce.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shipment-post-at.apolline-voyance.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shipping.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shirazrobotic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shkzegydbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shmqxraruy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shmxssjwfi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shnsiwfxng.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shobjjck.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shockedmustysymbols.brouling.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shooponliine.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shop.fixyourdirtbike.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shopeecoins.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shopeeday2022.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shopolx-product.8900076.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shopping-allegrolokalnie.3659512.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shopping-inpost.11132212.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shopypanda.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"short-url.upr.ac.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200028562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"short.mypaste.fun"; content:"Host"; http_header; classtype:attempted-recon; sid:200028563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"short.upm.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200028564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shorturl-ddc.moph.go.th"; content:"Host"; http_header; classtype:attempted-recon; sid:200028565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shorturl.ac"; content:"Host"; http_header; classtype:attempted-recon; sid:200028566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shorturl.ae"; content:"Host"; http_header; classtype:attempted-recon; sid:200028567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"showysizzlinginformationtechnology.hauhrj.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shr-sharedfile-file.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shr-sharedfile-file.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shrill-flower-70e7.wearesre.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shrill-resonance-baf8.westloanewre.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shrill-waterfall-e99f.mooreslaw.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shrill.nxazenom.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shsksbnorl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shuixshur.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200028576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shutterislandsid2.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shutterislandsid4.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siatamask.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siaxtbhwmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siayu.indramayukab.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200028581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sicheresloginservice.dyndns.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200028582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sicherheitscheck-onlineportal-spk.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200028583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sichonwflq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sid-amiaz0on.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siddiquelawassociates.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siempredavivienda.davivienda3.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siempredelamano.atwebpages.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sifqrobmqc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sightseeing.instanthq.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-in-101327date.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-in-verification-929bb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-on-idaho.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-on-idaho.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"signedlines.wavoto.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"signin-att-mail-100274.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200028596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"signin-att-mail-104838.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200028597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"signinaccntsrvcssprtos.comoejiwutriesite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sigulemada.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sihjbglolp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"silent-darkness-b676.t0eajfnk.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siliconescuritiba.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200028602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"simgeprek.blitarkota.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200028603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"simhluefrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"simiandme.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"simmonrealestate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"simpkk.karanganyarkab.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200028607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"simplissimot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"simranarts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sincherelink.mymom.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200028610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sing.withup.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"singes.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200028612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sinkeffect.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200028613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sintelperu.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siodrgkraz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siom.agogade.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siporados15585.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sisale.2022outletsdiscount.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200028618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sistemadeverificacioncgr.webnode.cr"; content:"Host"; http_header; classtype:attempted-recon; sid:200028619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sistemaverde.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200028620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sistemel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitbwyswdx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site-4403463-3995-6112.mystrikingly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9423623.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9423773.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9434107.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9548676.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9551459.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9552191.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9606042.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9607677.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9608556.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siteatendimento.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200028633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder157806.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder158541.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder159641.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder162459.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder167178.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder171156.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder171476.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder171681.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder172240.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder173021.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder174827.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder175112.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder175184.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder175814.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder176428.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sivetgjcsk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siwjkuxpso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siwmqsofjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sixvhdrmss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siywimbelg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siyywkqajl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sizevchiez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjbbezowmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjbhbhvff.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjbpwvohqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjbwzplzds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjgpqscwfg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjhhskbxxe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjhsgsghhshzkkjhz-dotah6640111050.codeanyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjieddwwyg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjihbvngxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjioauxmzo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjiuteptlw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjmbqmpkxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjnkxlmwcs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjnqgvslmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjoxeheczm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjrtp-proxy.marketopreview.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skbfkzzjgt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skbhmihazl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skbndfcnuk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skelyehztc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skgesnwzin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skinbid.biz.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200028677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skinbid.org.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200028678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skiqthegames.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skjrnigqiz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skjzpttjpt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skkk.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skky97.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sklep.automirmar.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200028684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sklepkody.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200028685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skmhrptqbx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sknwgfpabl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skotqbyfre.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skovogakrr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skqimqthwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skreldpewj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skrlfwtgyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skrogqvcfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skslgyxguq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skvaecdujx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sky-authenticate.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sky-authenticate.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sky247id.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200028698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skyblueenterprises.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skyfixers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skymavis-ticket.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200028701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sl18839399.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slam1.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slareltas.amclapaz.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200028704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slcdnenedm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slcksorftq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sldedfcmto.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sleepmaskz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sleepy-meninsky.5-255-104-136.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200028709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slefkcykve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slhiraibjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slhtzgcbfc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slicktech8.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slkebtscuo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slkvhuibpm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slmkufeckf.jon-jensen.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slmmvkedtk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slosansqsf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slowlinebag.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200028719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slutbweeuo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slutkissgirls.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sluuhbqhfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sluvptsuld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slwhhpaehd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sm777.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smal.lu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"small-bread-5670.wvesadsdfdsfd.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"small-disk-48bc.f57ny24z.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"small-dust-6c63.pontufbksd.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"small-rice-d2df.wadestones.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smarr.pics"; content:"Host"; http_header; classtype:attempted-recon; sid:200028731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartbperweb.q-exclusive.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartchaindefi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartfix-dapps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartgridsweek.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartmom.com.bd"; content:"Host"; http_header; classtype:attempted-recon; sid:200028736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartstoresoffers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbc-card.com.cedyna-cardbillingreport.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbc-cardouhg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbc-urbkdfhg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbc.co.jp.overlord.lol"; content:"Host"; http_header; classtype:attempted-recon; sid:200028741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbccard-jp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbcoyy.466914.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbcoyy.4q3zra.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbcoyy.656deg.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbcoyy.dhap34.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbcoyy.eqfdig.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbcoyy.fvva6q.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbcoyy.kc5v6f.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbo.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbrkx554k.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200028751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbxoemijp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smcd.amassssmed.culgfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smcovhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smdc-card.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smdc-card.lubosq.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smdoroqiek.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smehiqmfcu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smepp.uninp.edu.rs"; content:"Host"; http_header; classtype:attempted-recon; sid:200028759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smgeenlnle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smgolamalif.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200028761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smi.onlygfpics.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smiepyjhwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smizwyeqhb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smkkesehatanjember.sch.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200028765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smlzvhycjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smpgoldenflaskgold.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smpgoldenflaskgold.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smquvoytwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sms-info.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200028770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smsenligne.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smsmms.flazio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smsorangephonemail.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smsorangesmsmessage.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smsverificationmms.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smvrzvqrnw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smyafhaahf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smzeadaryu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sn-066660.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200028779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sn-28273739.ihostfull.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sn0010192920.byethost5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sn01002900.byethost5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sn28393030.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sn91892939.byethost15.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snbcvertess.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snbcvertess.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snbqmjixef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sndkleqeyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sndyfkrjct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sngnwgeuwc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snhshmpeev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sniqkkaitj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snivelinglightcoralequations.segurityitau.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snkwzfyuby.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snn919200390.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snourbrkek.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snowy-recipbaf.f57ny24z.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snowy-viol.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snpqrodltx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snrjynflyn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snrozhuehe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snt-manometr.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200028802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snveajoajo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snzcyfiiom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"so932809.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soanse92.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soarcondicionado.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soazkvanyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"socialcommunityrecoveryterms1809.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"socialcommunityrecoveryterms2022.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"socialcommunityrecoveryterms56.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"socialinfluencer.co.place"; content:"Host"; http_header; classtype:attempted-recon; sid:200028812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"socialtermsettingcomunitys092022.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"societe-generale-login.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"societe-generale-login.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"societegenerale-relementation.sad-borg.161-97-101-64.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200028816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"socnyustbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soejfiyyqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soezzmyvrw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sofe-firma.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soft-bank.hoyotg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200028821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soft-waterfall-85d3.henhigay285.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"softbonbxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soimyibnrv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sol-refund.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solanahackerhouse.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solanatimes.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200028827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solanaverse.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200028828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solawi-edlendorf.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200028829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solgasmedical.com.ve"; content:"Host"; http_header; classtype:attempted-recon; sid:200028830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soliascan.work"; content:"Host"; http_header; classtype:attempted-recon; sid:200028831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solicitud-prestamos.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solicitudprestamoalinstante-lbkperu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solitar.tempetahu.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solitary-butterfly-f885.execuisine672.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solitary-shape-8829.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solitary-woods.a30u7ihn.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solucao-para-todos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solucaodigital-online.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solucionesach.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solucoes-para-nos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solucoesr3.sslblindado.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solutionfun.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200028843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solutionportal.best"; content:"Host"; http_header; classtype:attempted-recon; sid:200028844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"somdrmptze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"some-block.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sonygvzxql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soodgndleh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sopac.org.py"; content:"Host"; http_header; classtype:attempted-recon; sid:200028849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sopbant44546.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sopo4873298.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soportebanco.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soportedefirmadigital.webnode.cr"; content:"Host"; http_header; classtype:attempted-recon; sid:200028853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sopxdkstpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sosfresh3sdf.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sospensionecontoparametro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sosyyufdlh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sotoesteban.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sottqxeriw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"souaxwaoh.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soulbound.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soumya252000.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200028862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"southamerica-east1-clean-algebra-356021.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"southamerica-east1-hardy-magpie-334101.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"southamerica-east1-noted-minutia-330211.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"southamerica-east1-semiotic-karma-356909.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"southbaywedding.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sovdbabcud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sovffejkyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sozlpmolfg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sp-ids.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200028871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sp379189.sitebeat.crazydomains.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sp477389.sitebeat.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200028873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sp869496.sitebeat.crazydomains.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spacegame.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200028875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spaltprsecured.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spar-kundendienst-online.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200028877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kontodepot-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kontodepots.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kontoeinzuge-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kontofiliale.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kontofilialen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kontogeheimnis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kontogewerbes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundekredites-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundekredits-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundelehre-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundendepots.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundeneinlage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundeneinzug.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenfiliale.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenfilialen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundengeheimnis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundengewerbe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenguthabenkundenguthabens.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenhalter.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundeninstituten.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundeninstitutes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundeninstituts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenkredite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenkrediten.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenkredites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenkredits.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenlehre.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenleitzahl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse-intern.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200028906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse-loginmain.deutsch-bnk-login.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200028907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse-personendaten.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200028908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse-proton.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200028909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de-checking-3007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de-checking-3021.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de-checking-3026.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de-checking-3036.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de-checking-3050.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de-checking-5008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de-checking-8003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de-server8.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200028917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de.edu-yy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de.finanzportal.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200028919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkling-glitter-159f.scrtygdjahg.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkling-rice-5e44.rockymtmgt969.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparklogistics.com.ua"; content:"Host"; http_header; classtype:attempted-recon; sid:200028922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparxinteriors.co.zw"; content:"Host"; http_header; classtype:attempted-recon; sid:200028923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spcdaklak.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spd-login-site.mymom.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200028925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spdilxkorg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spdpkcxlmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spectacular-sunburst-e1d8bb.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spectrumstorageaccess.yahoosites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spedisci-bper.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spedizionecard.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spedizionepay.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spemail5.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200028933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spentamultimedia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spenupcjoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spids-sp.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200028936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spinroyalem11.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spirecg.corsetul-boston.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200028938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spiritswap-gow.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-aktivierung.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200028940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-anmeldung.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200028941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-finanzgruppe.de.dkb-de-bamking-sessionid-truelogin-save.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200028942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-push.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200028943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-push.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200028944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-service-anmeldung.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200028945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-ssk-ksk-lsk-de.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200028946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk.24stunden-supportde.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200028947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk.customersde-support24.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200028948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk.deguidesrv-customers.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200028949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk.guidesrv-infode.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200028950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk.srverguidede-lnfoger.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200028951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk.srvguide-servicede.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200028952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk.support24-customers.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200028953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spkfod.coms.cso.gov.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200028954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spl-line-bb3b75.ingress-daribow.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200028955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spldwsypdh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spontaneous-macaron-1110c2.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sport-pay.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sport.protected-secur.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sportsbrooks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sportyelites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spotlessgiantfraction.u7ajqu2.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sprechls.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spring-unit-2937.terser-ham-0g3631.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sprpxpyfqc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sprtrcvry.cnfrmacn.scrthlp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spryciarskieinfo.click"; content:"Host"; http_header; classtype:attempted-recon; sid:200028967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sprytneinfo.click"; content:"Host"; http_header; classtype:attempted-recon; sid:200028968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sprytny-ksiadz.click"; content:"Host"; http_header; classtype:attempted-recon; sid:200028969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sptqpydvye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sptserov.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200028971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spuhlijtwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spvvivlkyk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spzemgggxf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqgmm4.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200028975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqkufy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqlpnzvdwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqmqhexwoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqotelciyt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqplmhgfnc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"square-breeze49.8re42b1g.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"square-tooth-6e6c.deemgriff6215168.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"squvwxtagf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqvhxxtwhi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqvpsrqrea.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sragqgbani.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srchrank.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sremalzpgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srfkvnjsmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sribfrjrwd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srisupfgzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srjpnnsxhe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srjuwyqjne.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srqjzaeqfs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srrato4agest.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200028995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srskrvmiie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srtqsvlpyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srupqxoyom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srv179982.hoster-test.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200028999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srvde-lnfoservice.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200029000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srvguide-servicede.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200029001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srvmqmsvqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srwyqsesoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sseguridadebrou.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssenclave.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssfklhcyzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssfskwkclq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssgdrh.6o1u0v.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200029008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sslxzzrrxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssmlsznyfp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssnugiizjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sso-garena.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssoauthglo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssrhtckwmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sstakegamble.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssunrgwpiu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssuqvjsbty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssvavnuzru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssytsusdsn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"st-online.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200029020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stackingchange.mymom.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200029021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staemcomnnunity.net.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200029022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stage-upgrade.nycgo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stage.apexpagebuilder.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200029024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staging-app.1inch.io.s3-website-us-west-1.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staging.aisecureme.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staging.egfwd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staging.eliteautomotive.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200029028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staging.halaladvisor.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200029029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stakegqmble.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staman.synology.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200029031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"standardamericanbullybreeder.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staratlas-event.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staratlas.os.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200029034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staratlas.se"; content:"Host"; http_header; classtype:attempted-recon; sid:200029035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"starchyelderlycones.bikingblak123.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200029036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"starlingbank.sdksoftdev.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"starttsboxfile.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200029038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"static-promote.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"static.88-198-119-108.clients.your-server.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200029040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"static2.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200029041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"static5.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200029042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"static6.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200029043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"static8.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200029044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"static9.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200029045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staticcheerfuldigit.pygseg.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200029046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"statisticssuccessheroes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"statushiper-222.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stbqnhbstn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcommuniltyn.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200029050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcommunity-cu55214809173.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200029051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcommunityxion.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcommunityxvnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcommunityxwev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcommunityzixn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcommunutiy.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200029056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcomunlty.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200029057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcomunntiy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcomuunlty.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200029059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcomuunuty.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200029060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamconmunity-com.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200029061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamconnumity.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200029062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamscommunlty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stedfstt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steeamcommuniity.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200029065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steep-water-ae2b.weslaox.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steep.bengkakbibirkuuu.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steep.kacangrecinonfirem.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steeplechasebuilders.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"step2-9f5d0.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"step2-9f5d0.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"step3-efc8c.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"step3-efc8c.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"step4-30f38.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"step4-30f38.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"step5-62e6a.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"step5-62e6a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepapp-minting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stephaniesmythe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp10-98e14.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp10-98e14.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp11-a7e2a.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp11-a7e2a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp16-52ee1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp16-52ee1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp17-d761f.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp17-d761f.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp19-ced6c.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp19-ced6c.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp7-98a8e.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp7-98a8e.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp8-c4298.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp8-c4298.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp9-54a62.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp9-54a62.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steris.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200029096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stevemaddencanadashoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stevemaddennetherlands.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stevemaddenshoe.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200029099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stevencrews.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"still-cherry-4888.hescohqq.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"still-mountain-a0ba.7pok2uvb.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stjfmwbunw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stllmrmpme.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stnvafrqbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stolizaparketa.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200029106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stollgroup.coms.cso.gov.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200029107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stom-unit.wptt.su"; content:"Host"; http_header; classtype:attempted-recon; sid:200029108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stomkinscommercial.com.aus.cso.gov.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200029109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-eche.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-eche.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-get.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-get.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-iq.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-iq.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-ko.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-ko.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-mx.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-mx.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-ow.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-ow.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-rkc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-rp.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-rp.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-trc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-trc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-wof.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200029128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storageapi-new.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200029129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storageapi-stg.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200029130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storenike365.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"striicswgj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"strikeitalia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"strugglestokids.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stsrdrdpwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sttakegamble.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stty.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"student-finance-help.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"student-finance-help.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"student-finance-portal.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"student-finance-portal.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"studentfinance-auth.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"studentfinance-auth.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"studentfinance-help.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"studentfinance-help.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"studio-lol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"studiolegalededoni.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200029147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"studiolegalefalchero.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stuttgart-valley.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200029149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stuye3890.byethost6.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stvukdhytx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stwwcyfmup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stxaavcnfr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"styleproof.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stylifehomedecors.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stzmlxyaey.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stzzyiuzoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"su.vc"; content:"Host"; http_header; classtype:attempted-recon; sid:200029158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suas-solucoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suawkibfnc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sub-evnt04.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"subjjflvvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"submit.refund.bgl8w.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200029163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"submit.tax.refund.lpivp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200029164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"submit.tax.refund.r1mi3.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200029165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"submit.txrefund.cey7b.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200029166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"submit.txrefund.jtcw8.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200029167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"subper.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"subsmartlink09.eventlink.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200029169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"subsworker.bid"; content:"Host"; http_header; classtype:attempted-recon; sid:200029170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"subulussalamkota.desa.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200029171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"successmovescandidates.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200029172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suchiappswap.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200029173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suctcazsxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sucursal29854888.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200029175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suefczwuni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suelunn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sufzwxkttb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suggia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suhbftmvlz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suiviticket.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200029181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suizlyymft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sukjsgwvih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suksvhpktg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sukudoanalytica.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sultan-raza.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200029186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sumary.repport-fb.accts-protocol.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sumicorp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sumitomomitsui.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sumkdsklpm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"summary-fb.report-accts-notification.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"summary-protocol.report-accts-notification.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"summary-tracking-package-problems.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suneos.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200029194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sunnygods.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sunnylandingpages.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sunpolymers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suozmzopzc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"supe.seharusnyakita.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"super-block-1b89.tmp6n9c0.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"super-magalu.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200029201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"superecharge.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"supermundomagazine.store"; content:"Host"; http_header; classtype:attempted-recon; sid:200029203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"supernuts.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200029204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"superspeedtrain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"superstep.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"supgyqpopw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suplicgalicar.supploc.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200029208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suportecliente.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200029209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"supp0rt-ovh.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suppliers.bitshepherd.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support-dapps.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200029212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support-helpcenter567106982.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support-helpcenter567106982.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support-helpcenter716262119.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support-helpcenter716262119.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support-ihrkonto.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200029217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support-io.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support-kontopruefung.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200029219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support-sfr-client.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support.globepropertymanagementservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support.pancakesvqp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support24-customers.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200029223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"supportusermail4.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"supwuqhyis.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sur3cr.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"surnprmcrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"surveyol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sushiswap29474.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sushiswapsas.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200029230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sushiswfsdfgdfbc.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sushitokenusd.com.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200029232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"susunan1004.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sutherlanglobal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suvvcmayjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suvvcutqwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suyi.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200029237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svcjttiqme.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svdhg.bhgzpub.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200029239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svdkvmrgla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svg.fzsjbbm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200029241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svjjphlxoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svouznlenv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svphxdpors.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svqvpxwhkj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svqxnnciio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svrdnykoje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svsg.mjazbgn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200029248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svtlvpfbmh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svvhcbinls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swaggerhub-noprod.mibanco.com.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200029251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swallomization0-docuemnt-webapps-l5cbc.ondigitalocean.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swancommunications.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swanholm.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200029254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swanzltkkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swap-bsc.tokentool.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200029256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swappauto.staging.lcsolutions.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200029257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swapuni.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swckvwbqus.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sweet-efax7656554545-aebf.82929222-happygringo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sweet-math-855f.jpatelvemvo9033.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sweet-sea-37d9.vgreengolf8866.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sweyjxdgso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swhtgnkoqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swiftszapprotocol.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200029265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swipeindustry.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"switch-rectifier.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"switstart.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"switzapps.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swjzxyavvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swniemvsax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swqqkzszar.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swrnibrqpj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swsofkyodq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swsycmipvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swtwplrmpg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swupsnfqxf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swuzux8fruchlh.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200029278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swxaytbshx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swxtsdhxoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swzalfrwcn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxkbewkdlm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxpuejctyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxuiftdplt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxvzzzsxjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxxbljzqbb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syadtzovta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syatwea.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sybwlaipcb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sydenhampharma.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syebhjwufj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syeulzfuwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syfeifqzbx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syfxdqqjmw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sygeforsikring.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sygeforsikring.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syjzvilcrt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"symabeautyoriginal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"symimfkffg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"synaxisreadymix.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncbotzfixer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncconetbinace.quest"; content:"Host"; http_header; classtype:attempted-recon; sid:200029302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncelivevalidate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncfixdapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncwldapp.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syneos.benefitsaccess.ehr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syneos.gsgcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200029307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syneoshealth-iso.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"synews.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"synsauths.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"synsauths.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"synslabs.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syqvuirowl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syykpnjopz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szbeqduohx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szexpgdciy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szg2ro.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szhwripoqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szjrqckfvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szkurungvr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sznovatech.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szpczyfimu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szpdymbgdw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szpwvaoyhw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szpwxjjhcz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szsrpvnikw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t00b.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t10note.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t10note.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t11note.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t11note.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t12note.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t12note.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t1note.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t1note.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t2note.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t2note.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t2xmzm.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t3note.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t3note.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t5note.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t5note.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t64jnp.transchempharma.co.ke"; content:"Host"; http_header; classtype:attempted-recon; sid:200029343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t6note.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t6note.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t7note.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t7note.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t8note.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t8note.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t9note.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t9note.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tacgkvezfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tagomhdglr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taher-mohamed-ahmed-saad.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200029354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tahfsqplma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tajolqpbiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"takudrop.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"talents.com.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200029358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"talktalkea.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tambunanajaa.martulangsore.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tamiang.go.th"; content:"Host"; http_header; classtype:attempted-recon; sid:200029361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taniaexplores.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taonsmvzmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tapmrmjgpe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tarakcdqqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tarpwuuleq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taskmbox493.softr.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taupe-chaja-e09db0.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tavuuoljud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tavuwmhidu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tax-financial-irs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taxinfo.blob.core.windows.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200029372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taxjdfbfuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taymgvczxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taysee-servis.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200029375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tazicbrwgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tb915hdh89.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200029377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbaiulxfdf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbbswalziu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbgbodvlrr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbghmrsbxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbinjmmvlv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbmxesojvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbqlupzloe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbtoqxiefh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbv265743bv7.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200029386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tby.eb-sites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcaconnect.ac-page.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcalwsgaem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcdnbtilta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcegvkkdtq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tceukhonhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcfcypdray.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcfwbwdvhg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tckedcxlqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcllccdfvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcmjwthiuh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcnlpramju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcnsmdqdux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcoe.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200029400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tconoyjnoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcvatqcuqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcvoifxawv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcwwmyvrcg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcxaayview.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcxwbyltqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdbbxufdyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdlwxmihpe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdopwlqodb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdqhyxlmnu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdrqcdbygv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdsecurities.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdsecurities.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdtkzlreib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdvbetmunk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdyvoxzpwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdzjqbayhp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdzsfikvda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teamemc2.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teamgoogle125590.psee.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200029420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tebapit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"techlens.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200029422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"techniair.ma"; content:"Host"; http_header; classtype:attempted-recon; sid:200029423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"technocareindia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tecmachine.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200029425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tecnominproductos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tecqferlpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tedzgucwwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teekitstorage.blob.core.windows.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200029429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teenmg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tefttjiyfz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tehacarrasa.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tehhhaonao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teknob.my.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200029434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tele-0002.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teleko.97db.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200029436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"telhanorte-90.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tellmeliu.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200029438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"telstra-823a7434e49e.intercom-clicks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"templat65sldh.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200029440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"temporalrapiddeadcode.asassama.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200029441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"temporary-url.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tender-aryabhata.185-101-35-187.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200029443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teqformyil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"terjalapakkz.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"terpelsicumple.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"terpsearch.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"test.gogodimsum.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"test.lonase.sn"; content:"Host"; http_header; classtype:attempted-recon; sid:200029449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"test.staypoland.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"test.webclient4.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200029451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"test2.blackzdesignz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"testingmir.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200029453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"testnet-v2-pancakeswapclone.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teuelaytrj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tewgkxgwwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"texasfreedomrun.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tffuvdzkib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfhmerkhvt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfiwbwlonn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfnxposgbu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfqpynlmdw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfqvyesqyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfrpbtjyby.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tftfqpyaif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tftxomocsj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tftygstlsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfvymmohjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfyjanxauq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tg.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200029470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tg0c4r4p3an6fj1nhu6oa6fb95d57kruqle7v2fdefe779r02n8f840.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200029471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgacay.transchempharma.co.ke"; content:"Host"; http_header; classtype:attempted-recon; sid:200029472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgcmex.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgerycfpss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tggbiblyoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgjpjccycv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgkcljbaoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgkkbpucwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tglnbytkyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgmwanwykw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgniixxqkx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgnjbqdqym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgnjhnvoub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgnunogkzu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgocapital.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgpusmjgsl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgqakwjcmi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgqdmvrrgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgqkpnnjvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgrmastermind.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgrzqirgec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgsafajgtg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgscpijerr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgsrihgeup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tguwaipscl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgvelzneqc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgywwjhdxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgzhwhotdh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thadueqexq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thaiocixxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thdnmnncjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thdpbhgibo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"the-arenaa.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thebodyandmindclinic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thecatbreeds.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thecelticland.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thecreationentertainments.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thecrytpchain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thedefiantsnft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thedindalin.mom"; content:"Host"; http_header; classtype:attempted-recon; sid:200029510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thedreamstudio.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200029511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thedrinkersnepal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thefunkacademy.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200029513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"theglowconference.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thegoda.wl-minting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"themarketprof.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"themettaworkshop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"themichaelleeband.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thenameclothing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thensow.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200029520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thenudeinsider.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thenunksaxvhist.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"theopenseanft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"theoriginal360.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thepromiseofbitcoinafrica.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"theracoeurneige.mom"; content:"Host"; http_header; classtype:attempted-recon; sid:200029526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"therizzos.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200029527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thesmartnetworld.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200029528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thespace.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200029529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"theswisscom.hobby-site.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thetanarena-moba.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thetruthapothecary.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"theurbanfarmstall.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200029533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thexaynjk.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thgnxpkopu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thinhanphatco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thjhlqfomd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thjiansukl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thlcnxhsfm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thoixvdwxz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tholjddxed.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thongtacconghanoi.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200029542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thornybrokensyntax.allstarshb.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200029543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thozhilnedam.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thqudrjatk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"three-retail-live.devicetradein.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200029546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"throbbing-lake3b1.yzqquix4.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"throbbing-paper-b06a.kimupson47353.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"throbbing-wildflower-4625.roundcubeupdateq.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thruf.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thsichlhkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thursdayvibeatt293933.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200029552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thvfnsiofv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thwsupjxbi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thwyzfdagd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thxziaophc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thyvnmmqpe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tibarumals.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tiburontest.icertified.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200029559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ticdbjkmox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ticolugar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tiddlywinksthetford.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200029562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tidy-ohita-2910.main.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200029563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tiehengroup-sharedfolder-0fficedocs.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tiehengroup-sharedfolder-0fficedocs.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tienqmpdkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tifdkbhxux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tighqqfqad.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tight-cell-853d.whybed6896573.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tight-salad-f8b7.sdk-ppd.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tigmjhjiza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tiinqcxsma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tijnyxxcqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tikfiwbxjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tilidplfns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"timfluoarh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"timzinepuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tintsoftravel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tiopbxcxbm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tipografieonline.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200029580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tismzytilr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"titrkcewxf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tivrvcielk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tiwdnztwji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tixskonved.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tiyarasz.cloudaccess.host"; content:"Host"; http_header; classtype:attempted-recon; sid:200029586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjaigkrfuk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjaxdrcxuo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjbaagxdiq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjbffbmjlf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjbufgdxxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjdumscnhd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjduuwynrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjelamqmgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjfqolnqyu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjkeynuqpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjkxjcnepy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjlmqdqlug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjmbuqkuse.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjopgfxxig.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjplqkagyg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjqmapwijc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjttfabvvt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjvrdbfvjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjvycxplvj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjwzydionc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjysxmhbcn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjzfnmdrdr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tk43hkdcna.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200029609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkbumcjzio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkdvygfvdn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkecwrodal.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkelctfhct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkfyzizwcd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkglujnkqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkhxtutbqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkisjykkwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkjb2019.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkjiipslxo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkoarntjot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkozgyuvmo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkssnxinsj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tktoclzjib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkwevgcfbc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkyvlrlzsk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tl-podecontar.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlaokzenpt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlatx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlcfsbelkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlebcgxxnv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlecorp03802.fra1.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlhgijycek.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlhgpydlzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlilcswfxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tllgawyyon.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlmgovztii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlmmwqxmnt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlnqsgwsxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlorrhngxe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tloyuscqhu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlpkccfees.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlqemdnyka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlwqzdvifh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlydajyvpt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlyryaejld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlzhdlvvbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmaikhrvjj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmbocscfpr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmfnmbohff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmgebzpesc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmglizjacp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmlasfviqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmmklgcmvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmmsvztcnh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmmvslrszs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmnaupybpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmodesatbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmptshjaph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmvsjyuurj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmxbxpoveo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmxdonrrni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tncapgyjyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tndsoft.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200029663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnhjxlfrrn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnieweyryl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tniffcvoxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnijurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnnhdvblgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnnnmixcke.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnpklgtgbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnucmmehic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnxvlykkuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"to-ken.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"toddler-town.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"todgiycksf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"toiefdzwbs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"token-max.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tolbdempln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tollfunding.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200029679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tomhglcicb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"toodtfqgcc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"toolusps.rescheduleandredeliver.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"topawzbwuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"topbonusleon.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"topielyhwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"topskills.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200029686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"topstocksolutions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"toqqbvagzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"toramfree.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200029689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"torccolborrachas.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tosyojgerp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"totalfitnessjuarez.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"touch-media.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200029693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"toursbangla.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"touzgcyiqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"towerresearch.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200029696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"towncountryimplement.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"toyotacarseries.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpddtgnjfr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpdmcjvgtl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpezkymvyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpfmkhqxmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpgiywqlru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpioxcsmid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpkqrpswqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpkzdkyoxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tplhalijcz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpnipgiubm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpnmggmmjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpplrkiips.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tppnnmxqnx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tppqtshxez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpyuinhmqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpyydkwowz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tqgscizdyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tqkndxjbty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tqlocktyia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tqnwosjejw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tqqiiqbtls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tqqzrxqbob.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tqtwysayqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tquokgkcoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tqvcwycgir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tqybxmkeie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tqzhwzsbwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tr.ertew4r345.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200029726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-10083.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-10083.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-20934.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-20934.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id2892.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id2892.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id4190.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id4190.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id7027.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id7027.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id7297.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id7297.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id8027.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id8027.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id8063.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id8063.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id8982.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id8982.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-redeliver.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-redeliver.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trackerc.osend.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200029747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trackgroups.unaux.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tracking-correos.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tracking-correos.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tracking-redeliver-afd2d3.ingress-erytho.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200029751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tracking.flowii.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trackingpending.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trackuse.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200029754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trackusinfo.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200029755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trade-iq-option-2021.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trade.dydx.exchange"; content:"Host"; http_header; classtype:attempted-recon; sid:200029757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trader.uniocean.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tradingbbex.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tradingplatformofficialsushiswa.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200029760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trailtire-auth-0ffice365-company.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trailtire-auth-0ffice365-company.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trak-post-ch.clan.rip"; content:"Host"; http_header; classtype:attempted-recon; sid:200029763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tramacol0002.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200029764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tramacol0006.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200029765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trams.mot.go.th"; content:"Host"; http_header; classtype:attempted-recon; sid:200029766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transaccionalcreditospagos.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transfer-wisea.app.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200029768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transformaoesfinanceira.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transitioncap.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transitpending.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transnetsporterminal.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200029772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transportal.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200029773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transterp.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200029774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trasfigurables.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trasfigurables.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trauogyqsg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"travelvisit-mexico.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"travlamp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trbzegvnep.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"treiuimkxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tresdghytu.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trfgdsfhjfgaz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trhgkj.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"triangularhonestcomputationallinguistics.96535.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200029785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tribelio.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200029786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tribratanewsbondowoso.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tribufin.co.zw"; content:"Host"; http_header; classtype:attempted-recon; sid:200029788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tribunbalikpapan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trickyoccasionalmedian.bamking1.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200029790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trivians.pancakeswin.click"; content:"Host"; http_header; classtype:attempted-recon; sid:200029791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trmjimxzni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tronwallet.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200029793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"troskmztss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trptpqtdcr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trubtpesmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"truegrip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trueid.stream"; content:"Host"; http_header; classtype:attempted-recon; sid:200029798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trulynolen.co.mz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"truspad-axieinfinity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"truspad-bondly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"truspad-magiccraft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trustpad-app.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trustpad-event.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trustpadclaim.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trustwallettop.easy.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200029806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trxenivuok.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trya673434.260mb.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200029808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tryh.gnccwbc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200029809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trymaxsurgical.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ts.hust.edu.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200029811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tscardjapan.work.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200029812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tsdzgqneqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tseuwubtxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tsitrucking.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tskaftzdej.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tslfqqxdxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tsme.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tsmfudnbwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tstapegjna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tsurl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200029821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tsvydcvnpm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tswizlxwbk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tsyrqokocz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttaohibnwc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttatithorritati.podcastheritage.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200029826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttbswmstht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttcswap.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200029828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttczdvioll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttdgjszfjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tteoehxkxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tthoysckpa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttiihhtgfg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttlfcwzrzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttnicubjri.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttnmdfkunq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttqcsgitmr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttsjfaapeq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttuuxqtupq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttwqcfblzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttyubcfkgjtf.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuannes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tubkcubqpp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tubytfcbvt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tudnft.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200029845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tudo-bem-posso-ajudar2b.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200029846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tudqbvwcvp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tudvcgcogx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuewm001.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuewm001.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuewm0010.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuewm0011.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuewm0011.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuewm003.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuewm004.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuewm004.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuewm005.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuewm005.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuewm006.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuewm006.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuewm008.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuewm009.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuewm009.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tugcecolakbeauty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tugowoqjsj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuievdfgsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuilsuka.org.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200029867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tukofertas.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200029868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuneahyt1.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecap933493843ionko.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecap9483493843jinka.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecap9589384384atomiana.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecapi008443943hunka.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecapi94834983denka.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecapi957343943hunka.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecapin746378.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecapo4873492kina.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecapp84873483.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecappi9384383utnduanaka.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchabvx6.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchaccn9.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchaii13.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200029882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchajhg5.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchajhg9.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchajj3.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchajqq7.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchajtt10.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchajzz6.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchakk4.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchali15.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200029890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchalk14.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200029891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchall8.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchalop3.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchanh1.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchaqq5.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchauy2.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchawk12.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200029897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchaww11.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200029898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecapu95839483dian.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunescapt8473843.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200029900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tupkvcquuw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuqdbtjqvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuqya1616taa.unaux.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"turningpointhomehealthinc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"turstwallet.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200029905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tusrzmmibb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tustudio.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200029907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tutor.iqsademo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tutorialghost.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tutoringbud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuy778kio09.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuy7a6w71.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuyainiciarcarlo.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200029913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuyaritagua.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200029914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuyarvadsghdfdg.great-site.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200029915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuyatargetone.ihostfull.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvgkaezyeu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvhasmdycu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvhlosnpfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvhyezauts.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvklyhxftj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvmlznxouh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvmwocxcqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvpfbbsnbj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvtftcgssa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvwdtbefgh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvwpublvqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvycfizpsj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tw.zbcgov.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twdcmmjlnm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twfqcwmjwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twhand.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twhhzdhixj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twilig.semangatpuasaaa.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twilight-heart-6678.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200029935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twilight.recomfiermsite.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twilioapp98273.azurefd.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200029937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twitter-customer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twitter-helpcustom.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twittercustom-help.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twittercustomer-help.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twittercustoms-help.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twitterform-custom.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twitterform-helper.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twitterhelpcommunity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twittermanagerhelp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twubhgouvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twuujooshe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twvagmzxxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twwskdcolf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twwypfgdus.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twxudmdrms.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twztorcyqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txclmxzdrw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txctbsfedi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txctxrlhhz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txdwmumpwz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txewbfwcoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txgelynyxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txgnbclkxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txhansahcu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txpmasqcki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txttzjhyvq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txuzpcyiyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txvcaxhndb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txxgytgzsw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txxohsruim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txzrkfsvgh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyaco402.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200029969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyaprtlahsbj.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200029970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tycmhrbwvl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyevnrhmye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyfgsdtagz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyftkfzuwc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tygwkhdtyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyhptxjltl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyivjakhqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyjlfevjhk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tykbprbijj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyrolevent.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyrrbggapb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyrvntbtni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyseycxajn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tysnzzloym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tytagxpvhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyugjjltiz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyuxidplgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyvrkdumoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyxsseccny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyzcamxwdd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzabjrciyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzbfsgktuh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzdmfxrtay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzdvgmgvrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzebiwexdk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzesqtdevr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzfbqhykao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzhhgvrapq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzhzcdpbzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzjpsegqap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzlekzlcyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzoieonviu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzsihhjfow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzstgsgxkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzuakldhwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzudlfmxaf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzurtenxir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzuwihfxeu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzvludjrmz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzvsidyuor.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzwelnyvya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzwlelbekp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzylzjgdff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzyvrbkjbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u14511627.ct.sendgrid.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200030015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u1742042.cp.regruhosting.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200030016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u1786707.plsk.regruhosting.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200030017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u18741649.ct.sendgrid.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200030018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u28745652.ct.sendgrid.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200030019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u3vii.codesandbox.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200030020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u4mwtv8bwaaxgr.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uaazbnknep.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uagpclxsbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uaisrleezv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uajyjjkryi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uat-new.wcv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uavydmpmvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uaywmvzlal.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uazrzqxqjb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubangr-scure-grnet.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubangr-scure-grnet.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200030031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubbfxbztwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubdanezotu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubeonvifys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uber.faster-delivery.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200030035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubnejurdvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubniokpyzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubrfnsamfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubuhwzvbyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubusodtrrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubydtupeqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uccoussakg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucfkjenxhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucgriadugz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uckmavcaio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uckwekscih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucltougkdh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucofez.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200030048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uconn-edu-online.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucorforrvf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucpygjvdes.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucrzhuquin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucuconmicoa.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucwjbvzlol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucxkcjfscr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uczpnmhaqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uczqlhkqrg.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uczqlhkqrg.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200030058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udanbhnnjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udawqlclir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udbetaling-sygeforsikring.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200030061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udeyxkcati.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udjntjdcfq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udlvtszjes.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udmappbaev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udmuljgcuw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udnieiqzev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udnmjhpzng.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udobxcltxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udqxlepkxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uebhydqqss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uecknwdfxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uecrtvaqei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ueeanoarna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uefqavlusq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uejpazepgv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uekzajrjzg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uelfynskgz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uetzuwzniu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ueyjjhwsma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufaiawrycn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufdhpsijll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufhcdtwyxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufmgliztyh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufndjbmxgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufnskqrjbv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufnttsfjtm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufrqfsdnva.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uftkxkkaza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uftoken.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufuynbnxxe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufvasnnjpb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugacfahlce.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugcgobicdy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugcqvlbcfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugfssbgten.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ughnxdvnhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugjwbayfpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugkgbkhjpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugnjscijld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugqphlzmcy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugxknsuaij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugxoytseet.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugyftdraq.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200030104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uhadlqzqhz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uhbtamhssc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uhbtkuhqhj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uhinwltqwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uhkbwsvsgv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uhoiwywiyn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uhoqpqtseh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uhtaudnruz.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uhtaudnruz.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200030113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uhujbcparc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uiazhknoip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uibhyfzqxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uibnvaavjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uibyppfzwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uidengojlj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uierjygeiz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uikposquhg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uikzrfkdbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uilvdczpxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uipemintca.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uipgmfghuq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uiqpo-xqaaa-aaaad-qdvda-cai.raw.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200030126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uirmmyzseo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uitbfxripp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uitpdohbap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uixcuxzwqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uiycqernbx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uiysyfuyjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujamachild.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujdmsdhzjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujfccwdphk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujgcavitwt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujlpfhwabc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujlwzxqcfb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujpljyqeec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujsfojferp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujvalbhsmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uk-evri-reschedule.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uk-evri-reschedule.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200030143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukaobdlbak.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukbcjfgqzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukehkmbgch.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukgwhgsrbx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uklnvkrgsp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukqpdqqvqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukraineconsulatelib.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200030150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukrxagpzxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukwglnmicg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukwnhmcfxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukwrksshlg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukxssepumr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukzgextebf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulbmsskmfp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulgroup.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200030158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulicmgsvcc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulillzomih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uljtfbpxfp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulnigahakb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulnoingray.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulouarodpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ululafjfih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulxclmwgzq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulykoagley.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umbptwefrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umcicdfoht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ume.la"; content:"Host"; http_header; classtype:attempted-recon; sid:200030170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umeqcbxpny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umioipdhrd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umklzgexdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umldrwdlwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umu.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200030175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umvrnedasw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umvufpysnj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"un1cef.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"un231m71wy.toutterroir.ma#.ahr0chm6ly9zmy5hbwf6b25hd3muy29tl2fwcgzvcmvzdf91zi9mmty2mzu3njuznte0n3g4nde3nzuznjawmdi5oduzmdavy21lbnqtchitawxpbmctzw1hawxpbmcty29sy28uahrtbcnmb3jty29udeb1bmlslmno"; content:"Host"; http_header; classtype:attempted-recon; sid:200030179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unabpvktqd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unam.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200030181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unaryazkzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"undergroundbats.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unect.edu.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200030184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uneedparts.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200030185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unfryquppt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unhwetetns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniassessoria.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200030188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unibper.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unicreditaustria.ucs.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200030190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uninstructed-tracto.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unioncredidesarrollo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unionheightsresidental.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unionn.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unisonsouthayr.org.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200030195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap-event.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap-exchanges.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap-uniswap.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap.openwallet.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200030199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200030200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap.samvitello.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap.token.im"; content:"Host"; http_header; classtype:attempted-recon; sid:200030202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap.umidao.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap.v2.testnet.pulsechain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswapfinancing.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200030205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unitatesteticadental.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unitedsolutions.pk"; content:"Host"; http_header; classtype:attempted-recon; sid:200030207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"universlsoftware.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unjardinideal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unjknlphfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unkegjmtbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unlocked5rgrkyvha.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unmttosbti.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unojapano.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unrifled-harpoon.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unripemildkernel.confirmatio2022.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200030216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unruffled-poincare.31-192-235-13.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200030217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unrxytldyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unryzroktj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unsub.listhandlr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unwelcomecompatiblecompiler.054webccpanell.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200030221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unwkxjgliz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unyku.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200030223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unzghycquh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unzixmcdbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uoaoblutic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uobdhcjnot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uofbljoern.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uon7jk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200030229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uormrykgrm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uoshntjjwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uotyncqhle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uoubdpkubh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uovnwyutaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uowucatizp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uoyhubfobo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uoyrmlrywj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"up5283773-298.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"up5283773-298.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200030239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"up5927731.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200030240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upbearin.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upceshop.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200030242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"update.attservice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200030243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"update.ilwg.ge"; content:"Host"; http_header; classtype:attempted-recon; sid:200030244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updateaddres-delivery.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updateaddress-ups.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updateatt19.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatemygpsdevice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatenorway-bankid-souf16130.codeanyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatepayment.anondns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200030250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updateservices.mymom.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200030251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatess.cfzijxcsp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200030252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatevoda-billing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatewindow12.chipilin.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200030254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updhlfsnjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updwryabpr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updykglghp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upfhemmqxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upgradelabs.pt"; content:"Host"; http_header; classtype:attempted-recon; sid:200030259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uphbkjucqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upjdvplxhc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uplchnikgp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upload1docportal.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upmdoyojlk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upmlufcufu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upnschgyur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upowgmpzcs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uprqtzddlt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ups-serviceupdate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upservday.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upsserviceverification.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uptiurncmn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upvdxqlnss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upwowdnjru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upxvzestqd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upzhlikslf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqauvmazwo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqbhqemooj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqeactesei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqeigqmeyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqemnmtfag.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqfnnkoicc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqgxddntjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqmrnxvjci.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqpbfqvieq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqrhesditz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqsgduicri.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqtkybvvzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqudhjhwkb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqvjbthdfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqvncxxvya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqwtiipgte.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqxrztocel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqypyvwmif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqzvarimwv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urahabhpki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urbxmpchdd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urdboceuly.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urfzaddllx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uri.im"; content:"Host"; http_header; classtype:attempted-recon; sid:200030300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uriaueo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urixlmnivx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"url.fti.or.th"; content:"Host"; http_header; classtype:attempted-recon; sid:200030303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"url.xcode.no"; content:"Host"; http_header; classtype:attempted-recon; sid:200030304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"url7455.city-monitor.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urli.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200030306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urnic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urnvmjafmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urpziolfxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urtigocolmbumbajiehfuerhfqe.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urtmhutmmn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urvgcikjwg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urwngqetsg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urzetvstbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-brooksrun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-east1-decoded-battery-359205.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200030316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-east1-diesel-practice-355319.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200030317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-east1-fine-blueprint-359703.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200030318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-east4-clean-algebra-356021.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200030319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-newmontcorp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-pack-forward-usps-reshipping.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-west4-mercurial-idiom-334123.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200030322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usa.get.dlsaster.tax"; content:"Host"; http_header; classtype:attempted-recon; sid:200030323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usaa-livee-online-update-start-confirmation-info-us.preview-domain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usadcmkdav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usdelivery-tracking.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usdfninmxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usdt-finance.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200030328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usdt-pos.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"user-mtb01.hufeer.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200030330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"user-olivierclemot.flazio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"user-pudgypen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"user-valida-tus-datos-bancolom.usinvalidar.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200030333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"user03b-citizen.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200030334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"userboitevocalweb.flazio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"userhelpdesk6.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"userinformationstoreupdatesmail.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200030337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"users.tpg.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200030338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usersupportv1.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usgligsfrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ushcaqhnly.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ushflxquuc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ushuvjfoxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usioevfgec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uslwgoumyg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usmogzlckq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uspackage999.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usportal-shippingauth.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200030348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usps-1-b67907.ingress-comporellon.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200030349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usps-mss.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200030350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usps3.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200030351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uspscity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uspsinformationupdate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uspsrequesting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uspsshippingauthentication.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uspyapione.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usqhustsji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usr-login-id.preview-domain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ussppss.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ustsoxtasg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ustsxyjzrr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usvfeywmse.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usvnxsjtib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utctspvggr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utehhs.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200030365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uthjzkziyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utkarshvilas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utkkkjymyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utoabdjvcn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utqwobhacx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utrosasjao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utyablxoyu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utzllzwzbm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uucawbybqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uucorbhyqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uuethhyfxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uufwnsnkmj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uugamwvohg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uulntzjjxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uunqmzmwxe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uuprgegoop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uurmywffpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uuvuejktzc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uuwhwokmiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uv09s6357.riggearf.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvafrozmxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvanifjqmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uverdnes.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uverus.my.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200030389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvftxpeiwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvhwourlbc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvhxilwzgk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvicmbvuho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvkgrccbrc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvodvtyenz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvrnkwsxpx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvrtpprdxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvvwgrtaom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvvxovihkr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvyiytirte.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwajnszgbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwalcegeuh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwcrcugpsz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwfihrcvtg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwgdaowhod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwhshykitk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwiimdmwvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwkbvaduha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwlkuavhnq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwmcfbwyix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwpxfmezys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwrqzjnqzw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwsltmkcct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwuvlexsvz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwvarwwfxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxebowzaxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxggvqlwgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxjgupgpjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxjragyofx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxooheyphv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxplyla1.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200030421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxplyla3.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200030422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxpqerqpoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxpsiqjdni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxs8ti.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200030425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxtykuxfvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxwdvpunhm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxylamwhsv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxzordzxlt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxzurhbcsp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyataandrrellosvb.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyataoveolandsdfadf.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uycqbrbykl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyeiezbqit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyfbbspqqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uygdeuiedgiuedu-5nsgrscxl6364789.codeanyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uygjzxbqwz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uygwcnqtzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uygxomgohy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyipfzfprb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uykclaafie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uykkiixgao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uymxvhuvml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyrh.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uytaportameniuheufasdf.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uytfgyiiif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyukaevgxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyupamvbiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyuropgymds.ihostfull.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uywuqvysup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyxihisiwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyxuetjrdn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzaoxpddhm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzaudedzfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzbbv-dyaaa-aaaad-qds5a-cai.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200030455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzcwkdvrnv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzdoyzk2.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200030457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzdykmshkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzfyuokujj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzielirsye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzifjzyvne.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzinjfijwg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzlnowdssm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzlzdyqfgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uznarhnonf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzrfyrwzye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzrzfmggnh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzsgfysypl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzshsgojke.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzwrcvzgoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzwtftywme.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzxtknldsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzycuymttn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzyigkkhzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"v1and1-ionos-info-2hyeo.ondigitalocean.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200030475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"v1claims.publicvm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200030476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"v39544-yahoo-co-uk.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200030477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"v5office365-owa6878.microsoftdynamics.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200030478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"v7qji0.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200030479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaalmaseru.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200030480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vabsnlsmdr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vadxvutmta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vafcycdbhe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200030483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.wyisqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.3nm.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200030613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.bwbril.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.metatv.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200030669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.wyisqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.xtslink.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200030816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.wyisqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.xtslink.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200030905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.metatv.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200030944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.xtslink.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200030979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.3nm.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200031072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.metatv.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200031234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.wyisqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.xtslink.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200031409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.bwbril.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.wyisqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.xtslink.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200031642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.wyisqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.xtslink.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200031766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.xtslink.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200031931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.bwbril.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.fqcmlink.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200032323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.fqcmlink.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200032488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.xtslink.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200032758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.3nm.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200032780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.bwbril.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.metatv.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200032860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.3nm.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200032951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.bwbril.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.fqcmlink.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200032990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.metatv.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200033027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.xtslink.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200033094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.fqcmlink.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200033158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.metatv.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200033194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.3nm.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200033283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.bwbril.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.xtslink.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200033425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.3nm.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200033446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.bwbril.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.metatv.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200033521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.fqcmlink.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200033655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaisceecicaaccrirasoiar.viessvacraooaccnirvaoneoseaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaisceecivaacarirsio.arvisevseacccooavsaoreosnnaosesonseosiren.bwbril.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaisceecivaacarirsio.arvisevseacccooavsaoreosnnaosesonseosiren.wyisqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaisceecivaaccrirasoiar.viessvacocooacvnaroeonsnaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaisceecivaaccrirasoiar.viessvacocooacvnaroeonsnaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscsecicaacarirsio.arvisevsaacrcooavsnaroeonsnaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscsecicaacarirsio.arvisevsaccovooasaoerosnnaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscsecicaacsriri.ovarisveascccvsooaaoeorsnmaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscsecicaacsriri.ovarisveascccvsooaaoeorsnmaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscsecicaacsriri.ovarisveascccvsooaaoeorsnmaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscvecicaaccrirasoiar.viessvacraooaecnirvaoneoseaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscvecicaacvrircaosari.veissacrvooaeanircrcnaoeeosaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscvecicaacvrircaosari.veissacrvooaeanircrcnaoeeosaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscvecisaacvrircaosari.veissvcoeooaacncrvaoneoseaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscvecisaacvrircaosari.veissvcoeooaacncrvaoneoseaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscvecisaacvrircaosari.veissvcoeooaacncrvaoneoseaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscvecivaaccrirasoiar.viessvacoeooacvnaroeonsnaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiwfrgkcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vajaewfqip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vakszvzrde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"valdtbemha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"valenciaoptometry.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200033792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"valiahorat.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200033793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"valida-tus-datos-bacnolombiasas.validabancolonb.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200033794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"validacionpichincha.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200033795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"validaritaupy.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200033796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"validatemywalletservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200033797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"validation-sfr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200033798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"valkonp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"valleymech-auth-0ffice365-folder.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200033800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"valleymech-auth-0ffice365-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200033801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vallianiaerodetail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200033802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"valueded.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200033803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"valuesfordailyliving.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200033804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vamerican.infomav.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200033805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"van-bussel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200033806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vanillagift.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaqnuegumz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaqtvggygb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vastdrpbjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vastlamebash.seguridaddavipl.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200033811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vawdzinnvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaxfg5.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200033813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vayfkvypir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbaailcghs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbbyqmfbxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbcjudfjda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbdfve-t5rge0tn-gnhe-tng-w0jf-0jr409jf-re.obs.ap-southeast-3.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200033818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbfbgcpqvz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbglvappfl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbgtad.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200033821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbhiawuylk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbkbnqjswl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbkvbxgdui.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vblk34hlk.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200033825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbpscmbqgp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbtf.bhxmyyy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbyjsfjnzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbzchzjspc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vc-107510.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200033830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vc.zbewwab.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vcbftagnhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vcbolkajtt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vcd.phxygqx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vcdjfluxvi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vcfmrkpvnk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vcgnfqwyim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vcguobjbsh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vciuhcixqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vckvobotjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vcrnornyqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vd.bhklxcq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vd.etujgza.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vd.hd0iqeh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vd.jf6r4fn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vd.jriy97z.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vd.layafm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vd.qtxkm1q.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vd.uqobvsh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vd.vnipqpz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vd.zjyzvxm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdbd.huoyanmao.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdbnj.2kk2950.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdcxdyprcr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vddf.85917.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdehujwfgavdse.mefound.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200033856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdf.lrqzrwb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdf.ysaxccr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdfbd.aqszyy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdfbf.75237.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdff.ansrmyy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdfn.37659.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdfnxoleup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdgawdas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdgsd.75187.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdhb.tech-stell.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdiskrwiru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdjhhxffly.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdkzaydzxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdpmuwfwok.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdqrgownlw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vds.by13j5s.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vds.dabluai.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vds.wofy4vv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vds.xmnclve.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vds.zltpkbl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdsjytwreshre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdtwjmxqua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdvf.kydbkxt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdwtylqcjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdx.13lnz2o.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veadodtnwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veeraja.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200033883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vegr.xmszyy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200033884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vehicletax.service.gov.uk.0vy3lpjix.persyar.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200033885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vehiculingbleu.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200033886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vehkpuaizh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200033887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vehno.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200033888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiceeesacvciracrsior.avisievseaaciccovsinaoeosnmer.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiceeesacvciracrsior.avisievseaaciccovsinaoeosnmer.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiceeesacvciracrsior.avisievseaaciccovsinaoeosnmer.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiceeesacveirccrasoria.viiessvaaciococvinsaoeosnmer.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veicesevaccairscri.orvaisvieascaccivsoioaoeosnmer.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veicesevaccairscri.orvaisvieaseaccivsoioaoeosnmer.b32mgr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veicesevaccairscri.orvaisvieaseaccivsoioaoeosnmer.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veicesevaccciracrsior.avisievsaaacircovsiniaoeosnmer.9v9w2y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veicesevaccciracrsior.avisievsaaacircovsiniaoeosnmer.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veicevecacasiricr.voriasvaiecsvasciiooaoeosnmer.puoo9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veicevecacasiricr.voriasvaiecsvasciiooaoeosnmer.vcgsip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veicevecacasiricr.voriasvaiecsvasciiooaoeosnmer.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiceveeacseirvcrcaorsai.vieissavcioeoacincvraoeosnmer.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiceveeacseirvcrcaorsai.vieissavcioeoacincvraoeosnmer.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veicevesaccvirccrasoria.viiessvaaciraoecinivraoeosnmer.com-deals.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.6mmfl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.7lnki4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.7ngywp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.9v9w2y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.awsgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.b4eqf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.com-deals.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.contius.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.cstztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.ehgmml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.fahxqk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.gamxhl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.hyhznq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.invpbv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.ioxsho.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.klgmfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.kpgvbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.ladyul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.mbirgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.nr5kfh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.ofldnb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.ogzbtb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.puoo9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.qvcxln.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.rgdpsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.tilzhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.upjhye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.vcgsip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200033988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.2sae6k.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.457e0p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.4i3si1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.5uzz0h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.650pt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.7hml9e.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.7lnki4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.7ngywp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.b6x80w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.bbl7ef.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.dnmsu6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.ehgmml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.fahxqk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.hycxop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.hyhznq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.invpbv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.ioxsho.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.iytxjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.lgwjlm.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.n21so.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.nfpdgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.patcfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.pjt9os.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.puoo9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.runjin007.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.shanchuta27.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.tilzhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.upjhye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.vcgsip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.vfqske.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.vkpock.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.wl85i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.wolvps.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.wwffoj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200034092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.3p1yb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.457e0p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.7hml9e.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.7lnki4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.7ngywp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.9v9w2y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.b32mgr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.b4eqf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.chashanchu48.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.chkmuq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.com-deals.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.contius.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.cqvlsi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.gjglse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.iytxjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.klgmfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.notwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.nrmzy6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.ogzbtb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.puoo9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.qfvbqx.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.rgdpsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.royjjy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.shanchuta27.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.uhia8h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.wwffoj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.5sime.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.7lnki4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.awsgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.com-deals.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.doenfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.hycxop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.hyhznq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.klgmfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.kpgvbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.mbirgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.mwdrbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.nrmzy6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.ph29h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.puoo9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.rjbvwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.saveyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.tilzhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.u25r5u.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.vcgsip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.wl85i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200034274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.3dbbmp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.457e0p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.650pt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.7lnki4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.awsgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.b32mgr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.b4eqf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.b6x80w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.bbl7ef.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.bs7dc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.cqvlsi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.cstztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.dnmsu6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.doenfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.flscly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.gjglse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.invpbv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.klgmfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.kuaiweichongwu14.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.lgwjlm.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.mwdrbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.nr5kfh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.nrmzy6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.patcfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.ph29h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.ptrwmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.puoo9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.qfvbqx.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.rjbvwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.rzuxzq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.u25r5u.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.vcgsip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.vfqske.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.vkpock.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.wwffoj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.2sae6k.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.3dbbmp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.4i3si1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.5sime.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.6mmfl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.8fgrh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.awsgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.bs7dc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.chashanchu21.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.chashanchu48.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.cstztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.dnmsu6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.doenfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.ehgmml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.fahxqk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.gamxhl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.gjglse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.l4p2g1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.ladyul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.mbirgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.n21so.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.nfpdgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.ofldnb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.pjt9os.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.puoo9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.qfvbqx.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.rgdpsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.royjjy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.runjin007.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.tbntv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.u25r5u.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.uhia8h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.upjhye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.vcgsip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.vfqske.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.vkpock.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200034511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.6mmfl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.7hml9e.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.9v9w2y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.b4eqf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.b6x80w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.bs7dc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.chkmuq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.com-deals.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.cstztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.dnmsu6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.flscly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.gamxhl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.gs3do.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.invpbv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.iytxjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.kuaiweichongwu14.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.lgwjlm.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.mbirgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.mwdrbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.n21so.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.nfpdgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.patcfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.ph29h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.pjt9os.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.puoo9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.qvcxln.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.rgdpsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.rjbvwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.rn5mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.royjjy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.rzuxzq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.uhia8h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.vfqske.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.vkpock.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200034634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.3dbbmp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.3p1yb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.457e0p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.5sime.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.6mmfl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.7hml9e.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.7ngywp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.9v9w2y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.awsgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.b32mgr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.chashanchu48.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.chkmuq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.com-deals.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.cqvlsi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.dnmsu6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.doenfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.flscly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.gamxhl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.gjglse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.gs3do.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.hycxop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.ihfo5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.klgmfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.kuaiweichongwu14.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.mbirgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.n6eonm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.nfpdgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.notwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.nr5kfh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.ofldnb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.ogzbtb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.pjt9os.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.ptrwmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.puoo9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.qvcxln.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.rn5mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.runjin007.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.rzuxzq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.saveyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.shanchuta27.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.tbntv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.tilzhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.vcgsip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.wl85i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.wolvps.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200034778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.2sae6k.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.457e0p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.650pt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.6mmfl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.7ngywp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.8fgrh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.awsgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.b4eqf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.b6x80w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.chashanchu21.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.chashanchu48.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.contius.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.cqvlsi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.dnmsu6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.gamxhl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.gjglse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.hycxop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.klgmfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.kuaiweichongwu14.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.ladyul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.lgwjlm.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.nfpdgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.ogzbtb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.ph29h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.puoo9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.qvcxln.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.rgdpsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.rjbvwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.runjin007.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.tbntv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.u25r5u.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.upjhye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.vfqske.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.vkpock.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.wl85i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.wolvps.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200034912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.3p1yb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.457e0p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.5uzz0h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.650pt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.6mmfl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.7hml9e.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.8fgrh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.bs7dc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.contius.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.cqvlsi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.cstztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.doenfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.gjglse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.gs3do.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.ioxsho.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.klgmfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.kpgvbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.kuaiweichongwu14.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.mbirgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.mwdrbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.n21so.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.n6eonm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.nrmzy6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.ptrwmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.qfvbqx.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.qvcxln.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.royjjy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.runjin007.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.rzuxzq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.shanchuta27.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.tbntv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.u25r5u.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.uhia8h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.upjhye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200035045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.3p1yb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.5sime.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.5uzz0h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.650pt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.7ngywp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.8fgrh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.b6x80w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.chashanchu48.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.contius.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.ehgmml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.flscly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.gs3do.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.hyhznq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.ihfo5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.ioxsho.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.iytxjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.kuaiweichongwu14.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.ladyul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.mbirgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.mwdrbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.nfpdgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.notwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.nr5kfh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.nrmzy6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.ofldnb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.patcfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.ptrwmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.puoo9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.qskgtg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.qvcxln.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.rgdpsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.rjbvwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.royjjy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.runjin007.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.rzuxzq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.saveyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.tilzhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.upjhye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.vcgsip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.wl85i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200035183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.2sae6k.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.3dbbmp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.3p1yb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.457e0p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.7hml9e.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.7lnki4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.8fgrh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.awsgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.b4eqf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.b6x80w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.chkmuq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.com-deals.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.cstztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.doenfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.ehgmml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.gamxhl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.gjglse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.hyhznq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.ihfo5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.invpbv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.ioxsho.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.l4p2g1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.lgwjlm.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.mbirgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.n6eonm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.nfpdgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.patcfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.ph29h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.puoo9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.rgdpsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.royjjy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.runjin007.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.rzuxzq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.saveyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.tbntv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.tilzhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.uhia8h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.upjhye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.vcgsip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.wl85i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.wolvps.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.wwffoj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200035326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vekboggclu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vektrofoods.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"velsaepdax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"venjsetjdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veoveo.com.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200035345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veqpnsurcv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veqydqibiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ver-2ji.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200035348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veranope.wwwaz1-ss44.a2hosted.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veredicto63.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200035350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifibank1.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200035351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifica-clientil-aggiornamento.dedyn.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200035352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifica-required.mymom.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200035353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificacarte.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificaportaleaccesso.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificate.sinup1.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200035356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verification-roundcube.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verification-roundcube.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200035358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verification.espace-particuliers.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verification.fb-page.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200035360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificationeminent.eminent58.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200035361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificationidn.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificationidn.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200035363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificationmessage.blob.core.windows.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200035364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificationmetamask.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200035365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificawebdispositivo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifiedownlpro.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200035367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifikasi-akun-anda0011.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifikasi-akun-facebook0022.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifikasi-identitas-accountt-c0m-id5.webnode.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200035370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifikasi-pengamanan-akun.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifikasifaceboook992.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifiquy.macrond.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200035373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifkasifacebook.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verify-banca6.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verify-email-e8a07.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verify-email-e8a07.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200035377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verify-webmaildata.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verify-webmaildata.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200035379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifychase.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifychase.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200035381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifycontactinfo.hopto.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifydevice-uk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifydevice-uk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200035384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifyid99847736628293000044.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200035385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifyinfos.freetcp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifyyyyy.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veriifyac.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"versehqvsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verskmyxcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verver9fvgj-ewrjfgv-9jwre-fvhnjw-e0hf-wefef.obs.ap-southeast-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vetrilsoftware.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veuiunfnon.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vevtxruxjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vewamqrnjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vewg9e30-5rg-0hwrghvnw-0hf-0whjfr4e4f.obs.ap-southeast-3.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vewilaotoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vewrbvger9t5g-hwrehgbn-0wherfg-0hwef-0hwqefef.obs.af-south-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vezxckazor.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfax-gstdr.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfax-gstdr.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200035401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfbf.75121.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200035402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfdbd.79976.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200035403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfdbf.jyxkypk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200035404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfdfwogtjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vffaenjqea.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfg.uwazju.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200035407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfgdh.gbdszyy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200035408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfnbyfogdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfnlqbldyi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vftzbocodi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfufngicyt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfupwpcdgz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfvujgilvj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vg2b4r2htaj8qc5mgq81qku11jt3ganu0trs2k0p8d6un4djesd3e3g.web3portal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vg8tb0n8hbu8ndv55evau4vh8hvfktpo14b9v1qrlvrpt222p74l5p8.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200035416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgckdsgxaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgdvgmnlbx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vghsuzgztz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgicintvpb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgitejdzcn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgjjjtoreb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vglqopswvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgmyiekbau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgphbkknlr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgpizglpfg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgpoivwizb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgqqdidrxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgqueayprk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgvgqzqwot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgvirfrkre.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgwzjzbmts.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgxjsxwgkn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhaiimfxsr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhbaghvtiq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhbkvvkazp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhee.o6cc.cfgliders.com."; content:"Host"; http_header; classtype:attempted-recon; sid:200035437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhfmynytgt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhgxjcqvtq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhknfstqgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhn.myjctc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200035441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhrelmzikr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhthuttgwv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhubcdnaco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhuhlylkym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhxolxjrcs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhyokxkece.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhzeyconej.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200035448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200035541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200035542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.p8ween.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200035575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200035592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200035713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200035714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200035746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200035764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200035887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200035888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200035919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200035932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200036054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200036055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200036087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200036105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200036130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaevsccvcrasoia.viessvacraoecnivrsiori.0633348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaevsccvcrasoia.viessvacraoecnivrsiori.nfxuax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200036230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200036231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.p8ween.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200036265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200036278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200036303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200036402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200036403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200036435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200036453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200036577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200036578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200036609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200036626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200036651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200036746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200036747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200036778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200036791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.upfi.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200036804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200036817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaievecsevrcaosai.veissvcoeoacncvrsiori.jpjxxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaievscvecrasoia.viessvacoeocvnsirori.mengdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200036916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200036917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200036948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200036962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.upfi.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200036975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200036988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200036995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200036998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200036999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200037088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200037089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200037121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200037136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200037161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200037258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200037259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200037291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200037307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200037331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200037429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200037430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200037462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200037479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavecsvcasi.visarveaiccvsior.eukwqr.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200037511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavecsvcasi.visarveaiccvsior.uvmqsl.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200037512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveescvcarsio.avisevseacccovsniorri.mengdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200037602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200037603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200037634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200037651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200037675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavesvccasri.ovaisveaseccvsoionrri.bwlepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavesvccasri.ovaisveaseccvsoionrri.sjmogv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavesvccasri.ovaisveaseccvsoionrri.tghtny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavesvccasri.ovaisveaseccvsoionrri.uiimkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavscvcasi.visvaraecivsior.geojvn.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200037687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavscvcasi.visvaraecivsior.hufctr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200037782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200037783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200037813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200037831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viabrasilaventura.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200037863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacaaeeeicecrei.viavaecrrasvccoieai.6123878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacaaeeeicecrei.viavaecrrasvccoieai.o4elaa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacaaeeeicecrei.viavaecrrasvccoieai.rfrnzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacaseeeiceceei.viaccraersvacrocierai.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacaseeeicsceei.viaceraersvacrocierai.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacaseeeicsceei.viaceraersvacrocierai.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacaseeeicscrei.viavaeerrasvccsieai.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacaseeeicscrei.viavaeerrasvccsieai.fiwzrb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacaseeeicscrei.viavaeerrasvccsieai.gjqyzk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200037960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200037961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200037990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200038005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.upfi.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200038018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacvoseaeaceceei.viaccrrsvcrooierai.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacvoseaeaceceei.viaccrrsvcrooierai.gvxyug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200038127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200038128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200038157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200038175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200038199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200038295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200038296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.p8ween.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200038329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200038345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200038463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200038464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.p8ween.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200038495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200038510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaivceesevcasi.viirsvoeaccvsior.usrrba.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vialbcp-pe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianiocenure.visoresiercmsvi.ftpstbj.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianiocenure.visoresiercmsvi.kzoatrc.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianiocenure.visoresiercmsvi.lmdmaum.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianiocenure.visoresiercmsvi.zikhocp.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianioceorcenure.visoreoecssiercmsvi.bwcpfbn.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianioceorcenure.visoreoecssiercmsvi.fcuccth.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianioceorcenure.visoreoecssiercmsvi.mrdefgv.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianioceorcenure.visoreoecssiercmsvi.ydtfxhz.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianiocercenure.visoreoecssvxarercmsvi.cnufsqh.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianiocercenure.visoreoecssvxarercmsvi.pefczzw.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianiocure.visorcsiercmsvi.hmamatm.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianiocure.visorcsiercmsvi.hynvkvn.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianioorcecure.visorcoecssiercmsvi.dwvwhpm.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianioorcecure.visorcoecssiercmsvi.fuivkxa.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianioorcecure.visorcoecssiercmsvi.gemisns.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianioorcecure.visorcoecssiercmsvi.lmbtnda.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianioorcecure.visorcoecssiercmsvi.ulztbbb.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianioorcecure.visorcoecssiercmsvi.yvlpjam.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianiorcecure.visorcoecssvxarercmsvi.dtgskgr.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianiorcecure.visorcoecssvxarercmsvi.lihewoq.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianiorcecure.visorcoecssvxarercmsvi.prcjndo.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianocenure.visoresiercvxarevi.dtgskgr.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianocenure.visoresiercvxarevi.eaplgjq.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianocenure.visoresiercvxarevi.ipvrmgx.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianocenure.visoresiercvxarevi.lghbwne.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianocenure.visoresiercvxarevi.needmwo.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianocenure.visoresiercvxarevi.ouqcrce.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianocenure.visoresiercvxarevi.pyamdhg.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200038569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.arowal.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.bomgwz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.bypiqw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.egrhtq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.eickib.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.fjfuni.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.fkbwav.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.gykmlg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.hbzhrq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.hloymq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.hqnjab.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.jvahcx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.khlzjd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.lndzay.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.lxxdeq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.lyiqnd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.lyxyuf.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.mbjhhd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.mqvjkr.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.ntdght.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.ovpzzh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.pdzcxc.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.pvqbdr.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.rdinpk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.rqrpjt.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.sfqlok.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.ukpvop.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.wfzola.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.wgkngu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.whdeeh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.yabztv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.yvzlne.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.zcyttz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.zkxahi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.zuaswx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.asciqo.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.bomgwz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.bypiqw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.eaezlo.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.egrhtq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.eickib.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.gkaxhu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.gykmlg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.gyyiwk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.hqnjab.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.jvahcx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.ksbgin.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.lndzay.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.lyiqnd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.mifikv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.mqvjkr.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.nbzllz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.ntdght.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.podujg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.qigfcj.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.rdinpk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.rqrpjt.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.sfqlok.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.ukpvop.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.upblku.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.uuppfm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.wfzola.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.wgkngu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.yabztv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.yvzlne.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.ziehxi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.zuaswx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.arowal.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.bomgwz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.bypiqw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.cmoqdm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.fjfuni.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.fkbwav.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.gykmlg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.hbzhrq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.hilrzx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.hqnjab.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.khlzjd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.lndzay.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.lyiqnd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.lyxyuf.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.mhlvfi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.nbzllz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.ntdght.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.pdzcxc.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.podujg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.pvqbdr.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.qigfcj.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.rdinpk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.sfqlok.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.ukpvop.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.upblku.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.wfzola.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.wgkngu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.xkpjpw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.xqjgyc.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.yabztv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.yvzlne.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.ziehxi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.arowal.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.bomgwz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.cmoqdm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.eickib.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.fjfuni.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.fkbwav.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.gpaqia.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.gykmlg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.gyyiwk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.hbzhrq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.hilrzx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.hqnjab.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.lndzay.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.lyiqnd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.lyxyuf.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.mhlvfi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.nbzllz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.ntdght.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.ovpzzh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.pdzcxc.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.pvqbdr.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.qigfcj.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.rdinpk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.rqrpjt.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.sfqlok.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.ukpvop.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.wfzola.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.wgkngu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.yabztv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.yvzlne.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.zcyttz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.ziehxi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.zuaswx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.arowal.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.bomgwz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.ciuwoo.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.cmoqdm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.eaezlo.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.eickib.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.fjfuni.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.gkaxhu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.gykmlg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.hbzhrq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.jvahcx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.khlzjd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.lndzay.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.lyiqnd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.mifikv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.mqvjkr.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.nbzllz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.ovpzzh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.pdzcxc.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.qigfcj.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.rdinpk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.rqrpjt.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.sfqlok.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.upblku.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.wfzola.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.wgkngu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.xkpjpw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.yabztv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.yvzlne.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.ziehxi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.arowal.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.bomgwz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.bypiqw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.cmoqdm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.eickib.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.fdtieg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.fjfuni.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.gpaqia.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.gykmlg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.hbzhrq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.hqnjab.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.jvahcx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.khlzjd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.lyiqnd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.lyxyuf.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.mqvjkr.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.nbzllz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.ntdght.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.ovpzzh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.pdzcxc.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.podujg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.pvqbdr.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.qigfcj.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.rqrpjt.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.ukpvop.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.upblku.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.uuppfm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.wfzola.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.wgkngu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.whdeeh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.yabztv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.yvzlne.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.zkxahi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.arowal.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.bomgwz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.bypiqw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.cmoqdm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.cufjaj.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.egrhtq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.eickib.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.fjfuni.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.gykmlg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.hbzhrq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.hqnjab.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.khlzjd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.ksbgin.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.lxxdeq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.lyiqnd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.mhlvfi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.mqvjkr.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.nbzllz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.ntdght.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.qigfcj.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.rdinpk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.sfqlok.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.ukpvop.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.upblku.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.wfzola.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.wgkngu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.whdeeh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.xkpjpw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.xqjgyc.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.yabztv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.yvzlne.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.zdknwh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.ziehxi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.zuaswx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.bomgwz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.bypiqw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.cmoqdm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.eickib.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.fjfuni.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.fkbwav.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.gkaxhu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.hbzhrq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.hqnjab.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.lndzay.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.lyiqnd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.mifikv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.mqvjkr.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.nbzllz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.ovpzzh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.pdzcxc.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.qigfcj.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.rdinpk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.rqrpjt.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.ukpvop.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.upblku.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.uuppfm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.wfzola.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.wgkngu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.whdeeh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.xkpjpw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.yabztv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.yvzlne.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.zdknwh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.ziehxi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.zuaswx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200038920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200038921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200038951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200038967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200038990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200038992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveaaevecrei.viavcrrvcoiea.08jtq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveaaevecrei.viavcrrvcoiea.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveaaevecrei.viavcrrvcoiea.5y4n9b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveaaevecrei.viavcrrvcoiea.9rjsbn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveaaevecrei.viavcrrvcoiea.ayqtuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveaaevecrei.viavcrrvcoiea.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveaaevecrei.viavcrrvcoiea.gzj8007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveaaevecrei.viavcrrvcoiea.lsikdoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200039095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200039096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.p8ween.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200039128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200039143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.upfi.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200039156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavecesvcasi.visvireaccvsior.ulyjlf.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200039175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveeaasverrei.vivacrcvcorie.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveesasvsrrei.vivaercvcsrie.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveesasvsrrei.vivaercvcsrie.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavesvcasi.visveaccvsior.qu5z38t.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200039179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavosaeaeceei.viaccrrvcooiera.l762j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavosaeasceei.viacerrvcosiera.3pax4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavosaeasceei.viacerrvcosiera.lkjhg65.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200039275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200039276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200039306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200039320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.upfi.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200039333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200039345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viazdkwwmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200039352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vibhfggkmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200039353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vibpuupqmz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200039354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vibramwyprzedaz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.acysue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.aetzyx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.aiczsa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.ajgwlg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.alcdkp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.atnpja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.attlqw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.axhyue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.ayvpej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.bangme.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.befurr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.bfuapo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.bvtbny.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.bxcbkt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.caipnu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.ccjole.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.cgrfee.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.cnjzqo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.cqikbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.cstvyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.ctsuwx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.deocmk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.dgqqzk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.dknouc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.dlhefx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.dlzdwm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.dpfplb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.dtlrgj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.dzpmfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.eiggzc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.enksln.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.eqfynh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.etibxf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.eytnjs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.fabbxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.fhylla.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.figdiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.gfrdxv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.guzomb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.hsobxm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.hsxsye.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.hyhijo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.hzmmyk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.iaowza.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.iazdui.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.icqbyi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.iieddd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.ilnsyb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.inilsf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.ipavwe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.ipckgf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.iqhnep.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.itoeyw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.jimkqm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.jjtebf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.jnvwvr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.jueaim.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.keiczj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.kqfoqs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.kuycqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.kvfyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.kvtqsz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.kyzuqj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.lavnql.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.lfeyoa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.llfmbd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.lltgtv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.lluhni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.lnhweo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.lyydbz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.maivih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.mcabmo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.mfnwca.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.mftcmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.mhvcvt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.mhxwoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.mnalmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.mrezau.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.mrkudt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.mtedjn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.mxfqsm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.mxphbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.ngdpig.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.nijizu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.nmdzpk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.noegdn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.npxbmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.nzuvrz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.oaotso.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.odgjer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.odmvmd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.oijbuk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.olgmmh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.osoqzr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.oudyit.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.oynnaf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.srlqyc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.tfwvbz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.utaekx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viccaaeeaicverei.viavaecrvasaccoiaei.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viccaaeeaicverei.viavaecrvasaccoiaei.gjqyzk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viccaaeeaicverei.viavaecrvasaccoiaei.luzpxb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viccaaeeaicverei.viavaecrvasaccoiaei.xinghuocf.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viccaseeaicaeeei.viaccraevsaacrocaieri.dsmxfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viccaseeaicaseei.viaceraevsaacrocaieri.qhcxdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viccaseeaicvsrei.viavaeervasaccsiaei.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viccveaeeaacverei.viavcrvsacroiaei.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viccveaeeaacverei.viavcrvsacroiaei.qcg3j9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viccvoseeaacaeeei.viaccrvsacrooaieri.zxj9002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"victorarath99.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200039467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.aetzyx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.aiczsa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.airnja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.ajgwlg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.alcdkp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.atnpja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.axhyue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.ayvpej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.befurr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.bjrlsn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.bkcywi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.byguuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.cgrfee.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.cpjomt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.cqikbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.cstvyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.ctfaoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.ctsuwx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.cxvesz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.daxqpj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.deocmk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.dkcyph.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.dknouc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.dlhefx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.dlzdwm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.dmgbrn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.dpfplb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.dtlrgj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.etibxf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.eytnjs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.fauyqv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.fhylla.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.fpyzoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.gclajk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.gfrdxv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.ggxtiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.gplcly.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.grlmkv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.guzomb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.gvbmgq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.hjoven.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.hkieuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.hldgqg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.hsobxm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.hyhijo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.hzmmyk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.iazdui.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.icqbyi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.ipavwe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.ipckgf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.iqhnep.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.isfnre.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.jhbjti.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.jnvwvr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.jokoqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.jrbyeg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.jvyhkm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.kadyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.kamowm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.kcsxhb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.keiczj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.khaylv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.klngsb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.kopnbv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.kqfoqs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.ktzhyt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.kvfyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.kvtqsz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.kyzuqj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.lavnql.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.llfmbd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.lluhni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.ludrij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.maivih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.mfrfhh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.mrezau.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.mxfqsm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.mxphbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.ngdpig.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.nijizu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.nkmpia.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.nmdzpk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.npxbmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.nscrlf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.nywlkd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.nzuvrz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.oaotso.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.odgjer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.odmvmd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.ohmvcj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.oijbuk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.okzwyp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.osoqzr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.pdkuld.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.puzdqh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.rijenl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.tfpdde.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.tztcbk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccaovvseon.visazcmieeeainsi.olycnz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.acysue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.aeaaij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.aiczsa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.alcdkp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.atnpja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.attlqw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.axhyue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.bangme.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.bdhjoe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.befurr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.bvtbny.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.bxcbkt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.bznaak.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.cbxspx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.ccjole.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.cgrfee.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.cnjzqo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.cstvyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.cxvesz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.daxqpj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.dbxmic.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.dbyapt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.deocmk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.dkxwtn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.dlhefx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.dohoyv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.dpfplb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.dzpmfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.ebaawf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.eegabi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.eiggzc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.enksln.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.epdexz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.eqfynh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.etibxf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.eytnjs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.fabbxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.fauyqv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.fpyzoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.fwmztl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.gclajk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.gfrdxv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.grlmkv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.gvbmgq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.gwvhgu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.hkieuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.hklvra.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.hldgqg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.hpvzmq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.hyhijo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.hzmmyk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.iaowza.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.ibdznx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.icqbyi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.ihytpv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.iieddd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.iksnzw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.ipckgf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.iqhnep.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.isfnre.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.jbgyvv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.jjtebf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.jnvwvr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.jokoqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.jrbyeg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.jvyhkm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.kadyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.kbubhp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.keiczj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.kklrfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.klngsb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.kopnbv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.kvtqsz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.lfeyoa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.llfmbd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.lluhni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.lnhweo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.ludrij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.lwbpzn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.lyydbz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.maivih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.mfnwca.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.mfrfhh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.mftcmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.mhxwoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.mrkudt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.mxfqsm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.nijizu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.nmdzpk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.noegdn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.npxbmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.nywlkd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.oaotso.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.odgjer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.oexeuz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.olgmmh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.orrpya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.osoqzr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.oudyit.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.oynnaf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.pdkuld.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.rfqqga.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.uiiavd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.aeaaij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.aetzyx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.aiczsa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.airnja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.ayvpej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.bangme.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.bfuapo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.bjrlsn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.bkcywi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.bvtbny.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.bxcbkt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.byguuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.bznaak.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.caipnu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.cbxspx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.ccjole.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.cgrfee.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.cluemm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.cnjzqo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.cqikbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.cstvyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.ctfaoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.daxqpj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.dbyapt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.dhitmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.dkcyph.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.dpfplb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.dtlrgj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.dzpmfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.eegabi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.eiggzc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.enksln.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.eqfynh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.etibxf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.fabbxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.fpyzoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.fwmztl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.gfrdxv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.ggxtiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.gplcly.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.grlmkv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.gubhky.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.guzomb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.gvbmgq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.hjoven.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.hkieuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.hyhijo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.hzmmyk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.iazdui.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.ibdznx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.icqbyi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.ihytpv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.iieddd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.iivqdq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.ilnsyb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.inilsf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.ipckgf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.jjtebf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.jokoqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.jueaim.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.jvyhkm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.kadyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.kbubhp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.kcsxhb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.keiczj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.khaylv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.klngsb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.kopnbv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.kuycqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.lavnql.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.lfeyoa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.ludrij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.lyydbz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.maivih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.mfnwca.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.mfrfhh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.mnalmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.mtedjn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.mxfqsm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.mxphbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.nmdzpk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.npxbmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.nscrlf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.nywlkd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.odgjer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.odmvmd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.oexeuz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.ohmvcj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.okzwyp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.orrpya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.osoqzr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.qgispn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.rpfjaz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnueszovvseon.visazeeevsioriursi.kaixbv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.acysue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.aiczsa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.attlqw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.bjrlsn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.bxcbkt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.bznaak.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.caipnu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.cbxspx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.cgrfee.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.cluemm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.cnjzqo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.cpjomt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.ctfaoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.ctsuwx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.cxvesz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.daxqpj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.dbyapt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.deocmk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.dkcyph.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.dknouc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.dkxwtn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.dlhefx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.dmgbrn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.dpfplb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.drvpxu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.dzpmfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.eegabi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.epdexz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.eqfynh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.eugwas.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.eytnjs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.fabbxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.fauyqv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.figdiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.fpyzoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.fwmztl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.gclajk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.gfrdxv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.ggxtiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.gplcly.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.guzomb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.gwvhgu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.hklvra.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.hpvzmq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.hsobxm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.hzmmyk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.iazdui.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.iieddd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.iivqdq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.inilsf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.ipckgf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.isfnre.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.itoeyw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.jhbjti.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.jimkqm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.jokoqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.jrbyeg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.jueaim.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.jvyhkm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.kamowm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.kbubhp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.kbuhif.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.kcsxhb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.khaylv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.kklrfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.kmuhkc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.kopnbv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.kqfoqs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.ktzhyt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.kvfyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.kvtqsz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.kyzuqj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.laguer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.lavnql.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.lfeyoa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.lltgtv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.lluhni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.lnhweo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.lwbpzn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.macpqa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.mcabmo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.mfnwca.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.mftcmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.mhvcvt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.mhxwoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.mrezau.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.nijizu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.nmdzpk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.noegdn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.nywlkd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.odmvmd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.oexeuz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.oijbuk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.olgmmh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.pdkuld.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.rijenl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.rujjog.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.vwprmh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.aeaaij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.aetzyx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.aiczsa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.ajgwlg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.atnpja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.bangme.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.bkcywi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.bvtbny.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.bxcbkt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.byguuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.bznaak.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.caipnu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.cbxspx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.ccjole.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.cgrfee.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.cluemm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.cpjomt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.cqikbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.cstvyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.ctfaoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.cxvesz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.dbxmic.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.deocmk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.dhitmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.dknouc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.dkxwtn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.dmgbrn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.dohoyv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.drvpxu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.enksln.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.eugwas.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.eytnjs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.figdiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.fpyzoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.frroav.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.fwmztl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.gclajk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.ggxtiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.grlmkv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.gubhky.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.gvbmgq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.gwvhgu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.hkieuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.hsobxm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.iazdui.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.ibdznx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.icqbyi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.iieddd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.iivqdq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.iksnzw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.inilsf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.iqhnep.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.isfnre.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.itoeyw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.jbgyvv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.jhbjti.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.jjtebf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.jokoqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.jrbyeg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.kadyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.kamowm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.kbubhp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.kbuhif.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.kcsxhb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.keiczj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.khaylv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.klngsb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.kmuhkc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.kuycqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.kvtqsz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.kyzuqj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.laguer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.lavnql.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.lnhweo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.lryoni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.ludrij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.lwbpzn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.lyydbz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.mfrfhh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.mftcmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.mhvcvt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.mnalmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.mtedjn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.mxphbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.ngdpig.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.nijizu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.njjguj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.nkmpia.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.noegdn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.nscrlf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.odmvmd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.oexeuz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.ohmvcj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.oijbuk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.okzwyp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.olgmmh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.orrpya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.oudyit.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.rijenl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.wstujx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.xbdhbi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.acysue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.aeaaij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.agxyxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.ajgwlg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.alcdkp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.attlqw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.ayvpej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.bangme.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.befurr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.bfuapo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.bjrlsn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.bkcywi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.byguuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.cgrfee.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.cnjzqo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.cpjomt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.cstvyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.ctfaoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.ctsuwx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.cxvesz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.dbxmic.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.dbyapt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.dgqqzk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.dhitmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.dkcyph.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.dkxwtn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.dmgbrn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.drvpxu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.dtlrgj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.ebaawf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.eiggzc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.epdexz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.etswbl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.fabbxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.fhylla.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.frroav.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.fwmztl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.gfrdxv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.ggxtiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.gvbmgq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.hkieuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.hklvra.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.hpvzmq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.hsxsye.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.hzmmyk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.iivqdq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.ilnsyb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.inilsf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.iqhnep.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.isfnre.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.jbgyvv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.jjtebf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.jokoqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.jueaim.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.jvyhkm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.kadyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.kamowm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.kbuhif.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.keiczj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.kmuhkc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.kopnbv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.ktzhyt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.laguer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.llfmbd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.lluhni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.lryoni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.mcabmo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.mfnwca.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.mfrfhh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.mhxwoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.mtedjn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.mxfqsm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.nkmpia.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.noegdn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.nscrlf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.oaotso.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.odmvmd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.oexeuz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.orrpya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.osoqzr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.oudyit.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.pdkuld.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.qgispn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.rijenl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.xnbziz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavisaccaeovseon.visaeiureeinsi.phkavb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavisaccaeovvseon.visecmiureainsi.tzzwdq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavisacnureszovvseon.esazcesioriursi.odujie.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavisacnureszovvseon.esazcmevsioriursi.psicaz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavisacnureszovvseon.esazcmevsioriursi.usoqts.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavisacnureszovvseon.esazcmevsioriursi.xdjnuh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.acysue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.aeaaij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.aiczsa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.alcdkp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.atnpja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.attlqw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.bangme.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.bdhjoe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.bjrlsn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.bkcywi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.bvtbny.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.bxcbkt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.bznaak.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.caipnu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.cbxspx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.ccjole.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.cgrfee.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.cluemm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.cpjomt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.cxvesz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.daxqpj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.dbxmic.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.dgqqzk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.dhitmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.dmgbrn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.dohoyv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.dpfplb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.drvpxu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.dtlrgj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.dzpmfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.ebaawf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.eegabi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.eiggzc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.enksln.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.eqfynh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.etswbl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.fauyqv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.figdiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.frroav.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.fwmztl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.gclajk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.gfrdxv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.gplcly.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.gvbmgq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.gwvhgu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.hjoven.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.hklvra.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.hldgqg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.hpvzmq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.hsobxm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.hzmmyk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.iaowza.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.iazdui.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.ihytpv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.iieddd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.iksnzw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.ilnsyb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.inilsf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.ipckgf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.jbgyvv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.jimkqm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.jjtebf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.jnvwvr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.jokoqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.jueaim.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.kadyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.kamowm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.kbuhif.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.khaylv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.kklrfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.klngsb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.kmuhkc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.ktzhyt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.kuycqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.kvfyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.kvtqsz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.laguer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.lavnql.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.lltgtv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.lnhweo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.ludrij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.lyydbz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.macpqa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.maivih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.mcabmo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.mftcmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.mnalmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.mrezau.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.mrkudt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.mtedjn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.mxphbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.ngdpig.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.nijizu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.njjguj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.noegdn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.npxbmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.nscrlf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.nywlkd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.nzuvrz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.odgjer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.odmvmd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.oijbuk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.olgmmh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.orrpya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.oudyit.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.rijenl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.ryqtlk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.vwprmh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.zzwuas.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.aeaaij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.agxyxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.aiczsa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.ajgwlg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.attlqw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.axhyue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.ayvpej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.bangme.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.bdhjoe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.bfuapo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.bjrlsn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.bkcywi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.bvtbny.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.byguuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.ccjole.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.cstvyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.ctfaoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.ctsuwx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.dgqqzk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.dkxwtn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.dmgbrn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.dpfplb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.drvpxu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.dtlrgj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.dzpmfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.ebaawf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.eiggzc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.enksln.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.etibxf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.etswbl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.eugwas.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.eytnjs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.fabbxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.fhylla.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.fpyzoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.frroav.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.gclajk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.gfrdxv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.ggxtiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.gplcly.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.grlmkv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.gwvhgu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.hkieuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.hklvra.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.hsobxm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.hsxsye.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.hzmmyk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.iaowza.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.ibdznx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.ihytpv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.iivqdq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.ilnsyb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.inilsf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.itoeyw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.jimkqm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.jnvwvr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.jueaim.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.kadyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.kcsxhb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.keiczj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.khaylv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.klngsb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.kmuhkc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.kopnbv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.ktzhyt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.kuycqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.kyzuqj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.laguer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.lavnql.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.lltgtv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.lluhni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.lryoni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.lyydbz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.macpqa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.maivih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.mcabmo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.mftcmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.mhvcvt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.mhxwoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.mnalmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.mrezau.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.mxfqsm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.mxphbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.ngdpig.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.nijizu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.nkmpia.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.nscrlf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.nywlkd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.nzuvrz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.oexeuz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.oijbuk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.olgmmh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.orrpya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.oudyit.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.pdkuld.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.rijenl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.umfbax.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.wvpeyp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.xfwrde.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnueovvseon.visazeeenvsioriursi.jwnhul.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnueovvseon.visazeeenvsioriursi.swhgkf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavisaaeovseon.visaeuenreeinsi.lqtahv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavisaaeovvseon.visemeniureainsi.cjimsd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavisaureszovvseon.eaenzcmevsioriursi.oeayuk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.aeaaij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.aetzyx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.ajgwlg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.atnpja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.axhyue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.ayvpej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.befurr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.bjrlsn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.bkcywi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.bxcbkt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.byguuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.bznaak.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.caipnu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.cbxspx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.cluemm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.cnjzqo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.cpjomt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.cqikbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.cstvyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.ctsuwx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.deocmk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.dkcyph.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.dknouc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.dlhefx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.dlzdwm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.dmgbrn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.dohoyv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.drvpxu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.dzpmfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.ebaawf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.eegabi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.eiggzc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.enksln.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.epdexz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.fabbxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.fauyqv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.figdiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.fpyzoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.ggxtiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.gplcly.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.gubhky.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.guzomb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.hldgqg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.hpvzmq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.hzmmyk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.icqbyi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.iivqdq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.inilsf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.ipavwe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.ipckgf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.isfnre.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.jhbjti.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.jimkqm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.jokoqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.jrbyeg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.jueaim.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.kadyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.kamowm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.kbuhif.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.kcsxhb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.keiczj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.khaylv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.kklrfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.kmuhkc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.kqfoqs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.kvfyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.laguer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.llfmbd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.lltgtv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.lwbpzn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.macpqa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.maivih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.mcabmo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.mhvcvt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.mhxwoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.mrezau.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.mtedjn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.mxphbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.nijizu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.nmdzpk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.npxbmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.oaotso.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.oexeuz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.oijbuk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.orrpya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.oudyit.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.pdkuld.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.puzdqh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.rijenl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.xfwrde.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.xokvig.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.acysue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.aeaaij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.agxyxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.aiczsa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.airnja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.ajgwlg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.alcdkp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.ayvpej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.bangme.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.bfuapo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.bjrlsn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.bkcywi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.bvtbny.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.bxcbkt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.byguuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.ccjole.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.cgrfee.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.cnjzqo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.cpjomt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.cqikbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.cstvyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.ctsuwx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.cxvesz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.dbxmic.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.deocmk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.dhitmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.dkcyph.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.dkxwtn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.dlhefx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.dmgbrn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.drvpxu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.ebaawf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.enksln.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.etibxf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.fabbxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.fauyqv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.figdiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.fpyzoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.frroav.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.fwmztl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.gfrdxv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.grlmkv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.gubhky.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.hkieuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.hklvra.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.hldgqg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.hsxsye.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.iazdui.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.ihytpv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.iivqdq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.ilnsyb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.ipavwe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.jbgyvv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.jhbjti.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.jimkqm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.jjtebf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.jnvwvr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.jokoqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.jrbyeg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.jueaim.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.jvyhkm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.kadyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.kbuhif.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.khaylv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.klngsb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.ktzhyt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.kuycqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.kyzuqj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.laguer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.llfmbd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.lltgtv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.lluhni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.ludrij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.lwbpzn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.lyydbz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.mcabmo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.mfnwca.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.mfrfhh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.mhxwoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.mnalmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.mrezau.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.mtedjn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.nijizu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.nkmpia.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.noegdn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.npxbmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.nscrlf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.odgjer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.ohmvcj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.orrpya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.osoqzr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.pdkuld.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.acysue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.agxyxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.airnja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.atnpja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.attlqw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.axhyue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.ayvpej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.bangme.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.bdhjoe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.befurr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.bjrlsn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.byguuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.caipnu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.ccjole.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.cgrfee.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.cnjzqo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.cpjomt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.ctsuwx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.cxvesz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.daxqpj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.dbxmic.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.deocmk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.dgqqzk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.dkcyph.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.dlzdwm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.dmgbrn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.dohoyv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.dpfplb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.eegabi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.epdexz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.eqfynh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.equmej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.fabbxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.frroav.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.gplcly.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.grlmkv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.gubhky.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.gvbmgq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.gwvhgu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.hjoven.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.hkieuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.hklvra.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.hldgqg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.hsxsye.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.hyhijo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.iaowza.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.iazdui.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.iksnzw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.ilnsyb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.inilsf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.ipavwe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.ipckgf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.iqhnep.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.isfnre.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.jimkqm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.jjtebf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.jnvwvr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.jokoqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.jueaim.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.jvyhkm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.kcsxhb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.kklrfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.kopnbv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.ktzhyt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.kuycqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.kyzuqj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.lavnql.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.lfeyoa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.lluhni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.lnhweo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.lryoni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.lwbpzn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.lyydbz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.macpqa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.mcabmo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.mfnwca.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.mfrfhh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.mftcmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.mhvcvt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.mhxwoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.mrezau.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.mtedjn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.nmdzpk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.npxbmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.nscrlf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.nywlkd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.oaotso.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.odmvmd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.ohmvcj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.oijbuk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.okzwyp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.osoqzr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.rijenl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.aeaaij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.agxyxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.airnja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.ajgwlg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.atnpja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.attlqw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.axhyue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.bangme.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.befurr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.bfuapo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.bkcywi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.bvtbny.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.bxcbkt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.caipnu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.cbxspx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.cgrfee.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.cluemm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.cpjomt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.cqikbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.cstvyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.ctfaoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.deocmk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.dgqqzk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.dkcyph.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.dkxwtn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.dmgbrn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.dohoyv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.drvpxu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.dtlrgj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.ebaawf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.eegabi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.epdexz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.equmej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.etibxf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.fabbxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.figdiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.fpyzoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.fwmztl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.gfrdxv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.gplcly.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.grlmkv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.gubhky.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.guzomb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.gvbmgq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.hjoven.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.hkieuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.hpvzmq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.hyhijo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.iaowza.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.iazdui.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.ibdznx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.iieddd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.iivqdq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.iksnzw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.ilnsyb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.iqhnep.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.isfnre.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.itoeyw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.jhbjti.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.jvyhkm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.kadyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.kbubhp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.kbuhif.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.kmuhkc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.kopnbv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.kuycqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.kvtqsz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.kyzuqj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.lavnql.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.lfeyoa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.llfmbd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.lltgtv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.lluhni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.lyydbz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.macpqa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.maivih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.mhvcvt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.mnalmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.mrezau.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.mrkudt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.mtedjn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.mxfqsm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.mxphbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.ngdpig.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.nijizu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.njjguj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.nywlkd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.nzuvrz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.oaotso.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.oexeuz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.ohmvcj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.oijbuk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.olgmmh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.oudyit.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.rijenl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.virtxq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.xkgblw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.ymewff.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.acysue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.ajgwlg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.alcdkp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.atnpja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.attlqw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.ayvpej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.bangme.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.bdhjoe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.bfuapo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.bjrlsn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.bkcywi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.byguuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.cbxspx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.ccjole.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.cgrfee.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.cnjzqo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.cstvyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.ctsuwx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.cxvesz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.daxqpj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.dhitmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.dmgbrn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.dohoyv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.drvpxu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.dtlrgj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.eegabi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.eiggzc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.epdexz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.fauyqv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.fhylla.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.figdiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.fwmztl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.gfrdxv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.ggxtiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.grlmkv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.gubhky.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.gvbmgq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.gwvhgu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.hpvzmq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.hsobxm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.hyhijo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.hzmmyk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.iaowza.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.ibdznx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.icqbyi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.ihytpv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.iieddd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.iivqdq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.inilsf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.ipavwe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.jhbjti.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.jnvwvr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.jokoqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.jrbyeg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.jueaim.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.jvyhkm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.kadyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.kamowm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.kbuhif.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.keiczj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.khaylv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.klngsb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.kmuhkc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.kqfoqs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.kuycqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.kvfyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.kvtqsz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.kyzuqj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.lavnql.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.lluhni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.lnhweo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.lryoni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.ludrij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.lwbpzn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.lyydbz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.macpqa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.maivih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.mfnwca.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.mhxwoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.mnalmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.mrkudt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.ngdpig.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.nkmpia.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.nmdzpk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.noegdn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.npxbmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.nscrlf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.oaotso.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.oijbuk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.oudyit.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.aiczsa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.airnja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.alcdkp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.attlqw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.axhyue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.bangme.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.befurr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.byguuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.cbxspx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.cgrfee.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.cluemm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.cnjzqo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.cqikbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.ctfaoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.cxvesz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.dbxmic.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.deocmk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.dknouc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.dlzdwm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.dohoyv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.dpfplb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.drvpxu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.dtlrgj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.dzpmfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.eegabi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.eiggzc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.enksln.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.epdexz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.eqfynh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.equmej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.etibxf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.etswbl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.eugwas.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.fhylla.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.figdiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.fwmztl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.gplcly.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.grlmkv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.gubhky.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.gvbmgq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.hjoven.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.hldgqg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.hpvzmq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.hsobxm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.hzmmyk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.iazdui.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.ibdznx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.iivqdq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.iksnzw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.ilnsyb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.inilsf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.ipavwe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.iqhnep.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.itoeyw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.jbgyvv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.jrbyeg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.kbubhp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.kbuhif.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.kcsxhb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.khaylv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.kopnbv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.kqfoqs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.kvfyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.kyzuqj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.laguer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.lavnql.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.lfeyoa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.lltgtv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.lluhni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.lryoni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.ludrij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.maivih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.mcabmo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.mfrfhh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.mhxwoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.mrezau.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.mrkudt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.mxphbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.ngdpig.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.nijizu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.njjguj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.nkmpia.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.nmdzpk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.nzuvrz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.odgjer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.odmvmd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.orrpya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.oudyit.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.qwnduy.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.rijenl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnureszovvseon.visazcmeevsioriursi.psicaz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnureszovvseon.visazcmeevsioriursi.usrwro.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnureszovvseon.visazcmeevsioriursi.vefkbx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnureszovvseon.visazcmeevsioriursi.yozdqk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccaeoseon.visazcmiueeneainsi.bvjqmk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.aeaaij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.aetzyx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.agxyxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.ajgwlg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.alcdkp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.atnpja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.attlqw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.ayvpej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.bangme.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.befurr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.bfuapo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.bjrlsn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.bkcywi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.bvtbny.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.byguuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.bznaak.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.cgrfee.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.cluemm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.cstvyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.ctsuwx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.cxvesz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.dbyapt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.dhitmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.dknouc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.dkxwtn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.dlhefx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.dlzdwm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.dohoyv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.dpfplb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.drvpxu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.dtlrgj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.dzpmfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.epdexz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.eqfynh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.equmej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.eytnjs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.fabbxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.fhylla.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.figdiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.frroav.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.fwmztl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.gclajk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.gfrdxv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.ggxtiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.gplcly.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.grlmkv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.guzomb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.hjoven.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.hklvra.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.hldgqg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.hpvzmq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.hsobxm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.hsxsye.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.iaowza.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.ibdznx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.ihytpv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.iksnzw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.ilnsyb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.inilsf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.iqhnep.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.jjtebf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.jokoqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.jvyhkm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.kadyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.kbuhif.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.kcsxhb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.khaylv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.kklrfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.klngsb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.kmuhkc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.kqfoqs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.ktzhyt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.kuycqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.kvfyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.laguer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.lfeyoa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.llfmbd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.lluhni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.lryoni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.ludrij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.lwbpzn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.lyydbz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.macpqa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.maivih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.mcabmo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.mfrfhh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.mhvcvt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.mhxwoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.noegdn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.oaotso.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.odgjer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.oexeuz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.oijbuk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.olgmmh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.orrpya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.oudyit.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.pdkuld.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.qfdotp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.wzqpee.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.acysue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.aetzyx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.agxyxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.airnja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.ajgwlg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.alcdkp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.attlqw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.axhyue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.befurr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.bfuapo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.bvtbny.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.bxcbkt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.byguuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.cbxspx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.cluemm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.cnjzqo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.cstvyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.daxqpj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.dgqqzk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.dhitmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.dlhefx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.dlzdwm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.dmgbrn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.dohoyv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.dpfplb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.dzpmfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.ebaawf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.enksln.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.epdexz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.eqfynh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.equmej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.eytnjs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.fabbxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.fhylla.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.fpyzoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.gubhky.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.gvbmgq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.hjoven.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.hkieuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.hsobxm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.hsxsye.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.iazdui.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.ibdznx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.icqbyi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.ihytpv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.iivqdq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.iksnzw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.ilnsyb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.inilsf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.ipckgf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.iqhnep.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.jhbjti.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.jjtebf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.jnvwvr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.jokoqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.jrbyeg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.jueaim.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.jvyhkm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.kbubhp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.kbuhif.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.kcsxhb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.kopnbv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.laguer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.lfeyoa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.lluhni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.lnhweo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.lwbpzn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.lyydbz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.maivih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.mfnwca.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.mftcmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.mhvcvt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.mhxwoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.mnalmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.mxfqsm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.nkmpia.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.nmdzpk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.npxbmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.nzuvrz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.odgjer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.osoqzr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.pdkuld.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.rijenl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.wposkr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnureovvseon.visazceenevsioriursi.hyxhne.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnureovvseon.visazceenevsioriursi.usoqts.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.acysue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.aetzyx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.agxyxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.aiczsa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.airnja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.atnpja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.attlqw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.ayvpej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.bangme.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.bdhjoe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.bfuapo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.bjrlsn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.bkcywi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.cnjzqo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.cqikbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.ctsuwx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.cxvesz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.daxqpj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.dbxmic.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.deocmk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.dkxwtn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.dohoyv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.dpfplb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.drvpxu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.eiggzc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.enksln.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.etibxf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.etswbl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.fabbxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.fhylla.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.fpyzoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.frroav.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.fwmztl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.ggxtiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.gubhky.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.guzomb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.gwvhgu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.hkieuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.hldgqg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.hpvzmq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.hsxsye.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.ibdznx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.icqbyi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.iksnzw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.ilnsyb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.ipckgf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.iqhnep.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.isfnre.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.itoeyw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.jbgyvv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.jhbjti.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.jjtebf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.jrbyeg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.kadyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.keiczj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.khaylv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.kklrfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.klngsb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.kqfoqs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.kuycqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.kvfyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.lavnql.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.lfeyoa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.llfmbd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.lluhni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.ludrij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.lyydbz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.macpqa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.maivih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.mcabmo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.mfrfhh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.mrkudt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.mtedjn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.mxfqsm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.mxphbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.ngdpig.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.njjguj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.nkmpia.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.nmdzpk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.noegdn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.npxbmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.nscrlf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.nywlkd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.odgjer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.oexeuz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.ohmvcj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.olgmmh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.osoqzr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.pdkuld.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.rhfwsh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.zckoua.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.acysue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.aeaaij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.aiczsa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.airnja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.alcdkp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.atnpja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.axhyue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.bangme.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.befurr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.bfuapo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.bjrlsn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.bkcywi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.caipnu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.ccjole.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.cnjzqo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.cpjomt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.cqikbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.cstvyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.ctfaoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.dhitmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.dkcyph.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.dmgbrn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.dpfplb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.drvpxu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.dtlrgj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.eegabi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.eqfynh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.equmej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.etibxf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.etswbl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.eugwas.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.eytnjs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.fauyqv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.fhylla.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.figdiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.fpyzoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.fwmztl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.gclajk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.gfrdxv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.gplcly.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.gubhky.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.gvbmgq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.gwvhgu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.hjoven.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.hldgqg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.hsobxm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.ibdznx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.icqbyi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.iivqdq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.iksnzw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.ilnsyb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.inilsf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.itoeyw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.jbgyvv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.jimkqm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.jjtebf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.jokoqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.jvyhkm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.kadyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.kcsxhb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.kklrfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.klngsb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.kmuhkc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.kopnbv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.kvfyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.kyzuqj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.lavnql.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.lfeyoa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.lltgtv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.lryoni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.lyydbz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.maivih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.mcabmo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.mfnwca.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.mftcmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.mhxwoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.mrezau.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.mtedjn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.mxphbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.ngdpig.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.nijizu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.nkmpia.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.nmdzpk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.noegdn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.npxbmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.oaotso.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.oijbuk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.orrpya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.osoqzr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.rijenl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.tfpdde.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.xokvig.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivisoaaeovseon.visazienureeinsi.tbtenr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivisoaureszovvseon.vsenazcesioriursi.hjrhmw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivisoaureszovvseon.vsenazcesioriursi.iowdcc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivisoaureszovvseon.vsenazcesioriursi.qthyus.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivisoaureszovvseon.vsenazcesioriursi.spsvre.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivisoaureszovvseon.vsenazcmevsioriursi.rtwmgc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.acysue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.aiczsa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.alcdkp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.atnpja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.bdhjoe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.bkcywi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.bxcbkt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.byguuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.bznaak.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.ccjole.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.cluemm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.cnjzqo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.cqikbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.cstvyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.ctfaoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.ctsuwx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.dbxmic.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.dbyapt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.deocmk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.dknouc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.dlhefx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.dlzdwm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.dmgbrn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.dtlrgj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.eegabi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.eiggzc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.enksln.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.epdexz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.eqfynh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.equmej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.etibxf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.fabbxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.fhylla.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.fpyzoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.fwmztl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.gplcly.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.grlmkv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.gubhky.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.gwvhgu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.hjoven.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.hkieuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.hsxsye.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.hyhijo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.iaowza.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.iazdui.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.ibdznx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.iieddd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.iivqdq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.ilnsyb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.isfnre.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.itoeyw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.jimkqm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.jjtebf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.jokoqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.jueaim.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.kbuhif.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.klngsb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.kopnbv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.kqfoqs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.kuycqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.kvtqsz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.kyzuqj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.llfmbd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.lluhni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.lryoni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.ludrij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.mfnwca.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.mftcmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.mhvcvt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.mhxwoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.mnalmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.mrezau.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.mtedjn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.mxphbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.nkmpia.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.nmdzpk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.nscrlf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.nzuvrz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.odgjer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.oexeuz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.ohmvcj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.okzwyp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.orrpya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.osoqzr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.rijenl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.umfbax.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.wzrrqp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.zznany.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.aeaaij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.agxyxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.aiczsa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.airnja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.alcdkp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.attlqw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.axhyue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.bangme.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.bdhjoe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.befurr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.bfuapo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.bkcywi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.byguuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.bznaak.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.cbxspx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.cgrfee.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.cluemm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.cnjzqo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.cqikbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.cstvyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.ctfaoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.cxvesz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.daxqpj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.dgqqzk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.dkcyph.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.dknouc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.dlzdwm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.dmgbrn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.dohoyv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.drvpxu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.dtlrgj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.ebaawf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.eegabi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.enksln.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.eqfynh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.equmej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.eugwas.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.eytnjs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.fauyqv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.fwmztl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.ggxtiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.grlmkv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.gubhky.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.guzomb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.gvbmgq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.hjoven.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.hklvra.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.hpvzmq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.hsobxm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.hyhijo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.hzmmyk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.iazdui.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.iivqdq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.isfnre.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.jjtebf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.jrbyeg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.kcsxhb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.kklrfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.klngsb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.kmuhkc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.kvtqsz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.kyzuqj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.lavnql.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.llfmbd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.lltgtv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.lnhweo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.lryoni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.lwbpzn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.lyydbz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.maivih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.mftcmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.mhvcvt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.mhxwoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.mrezau.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.mxfqsm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.mxphbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.ngdpig.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.nmdzpk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.noegdn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.nscrlf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.nzuvrz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.oaotso.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.odgjer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.ohmvcj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.oijbuk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.osoqzr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.pdkuld.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.rfqqga.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.acysue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.aetzyx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.ajgwlg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.atnpja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.axhyue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.ayvpej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.bangme.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.bdhjoe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.befurr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.bjrlsn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.bkcywi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.byguuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.cpjomt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.cqikbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.ctfaoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.ctsuwx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.dbyapt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.deocmk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.dgqqzk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.dkcyph.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.dknouc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.dlzdwm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.dohoyv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.dtlrgj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.dzpmfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.ebaawf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.epdexz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.eqfynh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.equmej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.fabbxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.fpyzoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.frroav.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.gfrdxv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.ggxtiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.gplcly.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.guzomb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.gvbmgq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.gwvhgu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.hjoven.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.hkieuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.hklvra.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.hpvzmq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.hyhijo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.hzmmyk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.ibdznx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.iivqdq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.ilnsyb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.inilsf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.iqhnep.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.isfnre.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.jimkqm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.jnvwvr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.jrbyeg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.jueaim.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.kadyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.kbubhp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.kbuhif.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.keiczj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.kmuhkc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.kqfoqs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.kvtqsz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.kyzuqj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.lavnql.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.lltgtv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.lluhni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.ludrij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.lwbpzn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.macpqa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.mcabmo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.mfrfhh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.mhvcvt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.mnalmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.mrezau.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.mrkudt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.mxphbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.ngdpig.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.nijizu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.njjguj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.nmdzpk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.npxbmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.nscrlf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.nzuvrz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.odgjer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.odmvmd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.ohmvcj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.oijbuk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.okzwyp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.olgmmh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.orrpya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.acysue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.aeaaij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.aetzyx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.airnja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.ajgwlg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.alcdkp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.attlqw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.ayvpej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.bangme.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.bdhjoe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.befurr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.bfuapo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.bjrlsn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.bkcywi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.bxcbkt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.caipnu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.cbxspx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.ccjole.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.cgrfee.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.ctsuwx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.cxvesz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.daxqpj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.dbxmic.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.dbyapt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.deocmk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.dgqqzk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.dhitmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.dkcyph.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.dlhefx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.dohoyv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.drvpxu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.dzpmfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.ebaawf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.eegabi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.eiggzc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.enksln.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.epdexz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.eqfynh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.equmej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.etswbl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.eugwas.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.eytnjs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.fabbxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.figdiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.gclajk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.gfrdxv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.gubhky.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.guzomb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.gvbmgq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.gwvhgu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.hjoven.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.hldgqg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.hpvzmq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.hyhijo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.iazdui.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.icqbyi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.iieddd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.iksnzw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.isfnre.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.itoeyw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.jbgyvv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.jimkqm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.jnvwvr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.jueaim.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.kadyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.kamowm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.kbubhp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.kcsxhb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.keiczj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.khaylv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.kklrfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.klngsb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.ktzhyt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.kuycqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.kvtqsz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.lltgtv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.lnhweo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.lryoni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.lyydbz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.macpqa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.mfnwca.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.mftcmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.mhvcvt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.mhxwoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.mnalmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.mrkudt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.mxfqsm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.ngdpig.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.njjguj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.nkmpia.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.nmdzpk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.npxbmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.nscrlf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.nywlkd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.nzuvrz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.oaotso.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.odmvmd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.oexeuz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.ohmvcj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.orrpya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.oudyit.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.pdkuld.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.rijenl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.virtxq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisoaccaeovvseon.visazcmiureainsi.bnrpkz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisoacnureszovvseon.visazcesioriursi.tzzwdq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisoacnureszovvseon.visazcesioriursi.vowycz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisoacnureszovvseon.visazcmevsioriursi.pigrir.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.acysue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.ajgwlg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.alcdkp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.atnpja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.attlqw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.ayvpej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.bangme.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.befurr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.bfuapo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.bvtbny.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.caipnu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.ccjole.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.cluemm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.cnjzqo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.cpjomt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.ctfaoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.daxqpj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.dbxmic.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.dbyapt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.deocmk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.dgqqzk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.dhitmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.dlhefx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.dmgbrn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.dohoyv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.drvpxu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.dtlrgj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.dzpmfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.eiggzc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.eqfynh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.etswbl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.eugwas.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.eytnjs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.fhylla.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.fpyzoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.gclajk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.gfrdxv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.guzomb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.hkieuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.hsxsye.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.hyhijo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.iaowza.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.icqbyi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.ihytpv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.iieddd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.iivqdq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.ipckgf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.jbgyvv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.jhbjti.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.jnvwvr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.jueaim.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.jvyhkm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.kadyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.kcsxhb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.khaylv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.kklrfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.klngsb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.kopnbv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.kqfoqs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.kuycqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.kvfyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.kvtqsz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.kyzuqj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.lavnql.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.llfmbd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.lltgtv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.lnhweo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.lyydbz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.macpqa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.maivih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.mfnwca.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.mfrfhh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.mhvcvt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.mhxwoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.mnalmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.mrezau.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.mrkudt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.mtedjn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.mxfqsm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.mxphbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.ngdpig.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.nkmpia.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.noegdn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.nscrlf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.odmvmd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.oexeuz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.okzwyp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.olgmmh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.orrpya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.oudyit.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.pdkuld.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.puzdqh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.sztsok.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseeeceic.rveivreaaevesi.fbgnzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseeeceic.rveivreaaevesi.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseeeceic.rveivreaaevesi.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseeeceic.rveivreaaevesi.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseeeceic.rveivreaaevesi.mravkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseeeceic.rveivreaaevesi.pbkjie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseeeceic.rveivreaaevesi.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseeeceic.rveivreaaevesi.qboxjl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseeeceic.rveivreaaevesi.qjtfvg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseeeceic.rveivreaaevesi.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseevei.cvrieversavesi.iktggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseevei.cvrieversavesi.ksdadl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseevei.cvrieversavesi.osqsyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseevei.cvrieversavesi.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseieececir.evirveiaaevesi.iktggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseieececir.evirveiaaevesi.jxsfsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseieececir.evirveiaaevesi.nbhlvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseieececir.evirveiaaevesi.qwudnh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseieveic.rveivresiavesi.frhyqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseieveic.rveivresiavesi.fynqxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseieveic.rveivresiavesi.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseieveic.rveivresiavesi.jxavqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseieveic.rveivresiavesi.lrtzrp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseieveic.rveivresiavesi.plqjhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseieveic.rveivresiavesi.qwudnh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseeeceic.eivreaaevesi.cjysqjj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseeeceic.eivreaaevesi.ckhnlk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseeeceic.eivreaaevesi.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseeeceic.eivreaaevesi.dlnxzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseeeceic.eivreaaevesi.dpqshv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseeeceic.eivreaaevesi.fksiud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseeeceic.eivreaaevesi.huaxiano.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseeeceic.eivreaaevesi.pvhngq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseeeceic.eivreaaevesi.ronipp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseeeceic.eivreaaevesi.rsfcmb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseeeceic.eivreaaevesi.vfchrz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseeeceic.eivreaaevesi.wbziul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseeeceic.eivreaaevesi.wetot.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200041753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseeeceic.eivreaaevesi.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseeeceic.eivreaaevesi.xudixq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseeeceic.eivreaaevesi.ymwfnw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseeeceic.eivreaaevesi.yqzemo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseevei.cveversavesi.ajvrm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseevei.cveversavesi.bdbbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseevei.cveversavesi.bjexfe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseevei.cveversavesi.ccvjar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseevei.cveversavesi.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseevei.cveversavesi.dauexk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseevei.cveversavesi.jkoozw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseevei.cveversavesi.lenorv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseevei.cveversavesi.msiesya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseevei.cveversavesi.upuphone.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseevei.cveversavesi.wetot.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseevei.cveversavesi.wetot.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200041769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseevei.cveversavesi.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseevei.cveversavesi.zliboyp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieececievirveiaaevesi.bporry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieececievirveiaaevesi.ccvjar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieececievirveiaaevesi.cntxao.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieececievirveiaaevesi.digitize.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieececievirveiaaevesi.fvqetn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieececievirveiaaevesi.htixjser.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieececievirveiaaevesi.jdqomw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieececievirveiaaevesi.ronipp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieececievirveiaaevesi.vfchrz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieececievirveiaaevesi.wxnyfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieececievirveiaaevesi.yavkol.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieececievirveiaaevesi.ytvuml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieececievirveiaaevesi.zliboyp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieveic.eivresiavesi.bdbbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieveic.eivresiavesi.bspybm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieveic.eivresiavesi.cjysqjj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieveic.eivresiavesi.dafenghao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieveic.eivresiavesi.digitize.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieveic.eivresiavesi.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieveic.eivresiavesi.hyfxgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieveic.eivresiavesi.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieveic.eivresiavesi.tvdoqx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieveic.eivresiavesi.upuphone.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200041794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieveic.eivresiavesi.upuphone.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieveic.eivresiavesi.urekwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseeecei.vivraevesi.bspybm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseeecei.vivraevesi.ckhnlk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseeecei.vivraevesi.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseeecei.vivraevesi.fksiud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseeecei.vivraevesi.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseeecei.vivraevesi.jdqomw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseeecei.vivraevesi.jkoozw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseeecei.vivraevesi.pkilix.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseeecei.vivraevesi.tqmskg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseeecei.vivraevesi.yavkol.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseeecei.vivraevesi.zjsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseevei.vivervesi.ajvrm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseevei.vivervesi.ayqtuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseevei.vivervesi.bzfdtw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseevei.vivervesi.digitize.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseevei.vivervesi.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseevei.vivervesi.nxxdqw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseevei.vivervesi.qskgtg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseevei.vivervesi.rsfcmb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseevei.vivervesi.ssrpsl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseevei.vivervesi.tvdoqx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseevei.vivervesi.urekwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseevei.vivervesi.xaeuyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseevei.vivervesi.ytvuml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseieecei.viriaaevesi.afevzf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseieecei.viriaaevesi.balaet.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseieecei.viriaaevesi.bdbbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseieecei.viriaaevesi.bspybm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseieecei.viriaaevesi.ccvjar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseieecei.viriaaevesi.cntxao.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseieecei.viriaaevesi.exoysm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseieecei.viriaaevesi.huaxiano.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseieecei.viriaaevesi.jdqomw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseieecei.viriaaevesi.quvhdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseieecei.viriaaevesi.tomorrowstduio.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseieecei.viriaaevesi.yqzemo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseievei.vivriavesi.badkfs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseievei.vivriavesi.jtuet.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseievei.vivriavesi.kpblio.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseievei.vivriavesi.lenorv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseievei.vivriavesi.pkilix.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseievei.vivriavesi.quvhdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseievei.vivriavesi.rkobagr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseievei.vivriavesi.ssrpsl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseievei.vivriavesi.tqmskg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseievei.vivriavesi.ttxupv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseievei.vivriavesi.upuphone.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseievei.vivriavesi.zblgxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseeecei.vivreaaevesi.cpclxs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseeecei.vivreaaevesi.dzniib.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseeecei.vivreaaevesi.jpxnnz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseeecei.vivreaaevesi.kzdaec.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseeecei.vivreaaevesi.mgfxpv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseeecei.vivreaaevesi.nyapck.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseeecei.vivreaaevesi.peqrlu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseeecei.vivreaaevesi.pilzbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseeecei.vivreaaevesi.sbonjn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseeecei.vivreaaevesi.taqabm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseeecei.vivreaaevesi.uktqmo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseeecei.vivreaaevesi.xioxfp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.apoljj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.axbhie.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.cbargn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.cndiyk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.dnjggs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.epmgtc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.fthjtm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.iezkxp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.lvuojw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.obnjjr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.pilzbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.rsxmth.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.vhwplz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.vmmoue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.vtihba.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.wssjge.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.xmigxe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseieecei.virveiaaevesi.dnjggs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseieecei.virveiaaevesi.dzniib.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseieecei.virveiaaevesi.flydpf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseieecei.virveiaaevesi.jpxnnz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseieecei.virveiaaevesi.lcuqbc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseieecei.virveiaaevesi.lqonrt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseieecei.virveiaaevesi.lvuojw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseieecei.virveiaaevesi.lymdeg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseieecei.virveiaaevesi.nlutye.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseieecei.virveiaaevesi.obnjjr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseieecei.virveiaaevesi.taqabm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseieecei.virveiaaevesi.tfdebx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseieecei.virveiaaevesi.vixxvg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseieecei.virveiaaevesi.vtihba.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseieecei.virveiaaevesi.vucabx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseieecei.virveiaaevesi.vunivt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseieecei.virveiaaevesi.wffxjj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseieecei.virveiaaevesi.zrmusc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseievei.vivresiavesi.cnzlue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseievei.vivresiavesi.dyjnbb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseievei.vivresiavesi.dzniib.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseievei.vivresiavesi.flydpf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseievei.vivresiavesi.jdjghn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseievei.vivresiavesi.kzdaec.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseievei.vivresiavesi.nlutye.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseievei.vivresiavesi.nsrsyf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseievei.vivresiavesi.nyapck.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseievei.vivresiavesi.phskmc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseievei.vivresiavesi.pruuwp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseievei.vivresiavesi.vjyswj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseievei.vivresiavesi.xmigxe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseievei.vivresiavesi.ygrkwy.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseievei.vivresiavesi.yjnkya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseievei.vivresiavesi.yyciai.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicveaeaaverei.viavcrvacoiae.gzj5019.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvoseaaaeeei.viaccrvacooaier.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvoseaaaeeei.viaccrvacooaier.iooazb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvoseaaaseei.viacervacosaier.9rjsbn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvoseaaaseei.viacervacosaier.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceiveci.vivrseiaveesi.cbargn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceiveci.vivrseiaveesi.fmdodt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceiveci.vivrseiaveesi.fthjtm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceiveci.vivrseiaveesi.fyyfxo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceiveci.vivrseiaveesi.iezkxp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceiveci.vivrseiaveesi.jdjghn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceiveci.vivrseiaveesi.jzemci.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceiveci.vivrseiaveesi.lqonrt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceiveci.vivrseiaveesi.nqawww.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceiveci.vivrseiaveesi.pfkndl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceiveci.vivrseiaveesi.pilzbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceiveci.vivrseiaveesi.pruuwp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceiveci.vivrseiaveesi.qigckf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceiveci.vivrseiaveesi.qytbke.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceiveci.vivrseiaveesi.rouqjs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceiveci.vivrseiaveesi.uktqmo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceiveci.vivrseiaveesi.vnsscq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceiveci.vivrseiaveesi.ymixml.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.aiinpw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.apoljj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.cpclxs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.fmdodt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.lqonrt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.lvuojw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.lymdeg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.nlutye.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.oaimcs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.pddjuu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.pxwxmw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.qigckf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.qyoqyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.sewril.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.stghfe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.uhdxmb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.uktqmo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.vmmoue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.vnsscq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.vucabx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.wylftw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.ygrkwy.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.yjnkya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.yyciai.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.ziuzyk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.zrmusc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceveci.vivsreaveesi.dyjnbb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceveci.vivsreaveesi.fmdodt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceveci.vivsreaveesi.fmmfcz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceveci.vivsreaveesi.hcnqqk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceveci.vivsreaveesi.ifpdph.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceveci.vivsreaveesi.nsrsyf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceveci.vivsreaveesi.oaimcs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceveci.vivsreaveesi.ojabvb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceveci.vivsreaveesi.pfxtar.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceveci.vivsreaveesi.sbonjn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceveci.vivsreaveesi.vixxvg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceveci.vivsreaveesi.vmmoue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceveci.vivsreaveesi.vusnur.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvscevei.vivsersvesi.axbhie.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvscevei.vivsersvesi.cpclxs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvscevei.vivsersvesi.flydpf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvscevei.vivsersvesi.iezkxp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvscevei.vivsersvesi.lymdeg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvscevei.vivsersvesi.peqrlu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvscevei.vivsersvesi.pfkndl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvscevei.vivsersvesi.prfshi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvscevei.vivsersvesi.pruuwp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvscevei.vivsersvesi.rsxmth.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvscevei.vivsersvesi.sewril.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvscevei.vivsersvesi.ymixml.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvscevei.vivsersvesi.ziuzyk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseivecic.rveivrseiaveesi.fiwzrb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseivecic.rveivrseiaveesi.ilpzgr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseivecic.rveivrseiaveesi.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseivecic.rveivrseiaveesi.jfmfyj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseivecic.rveivrseiaveesi.lwxxqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseivecic.rveivrseiaveesi.mhnved.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseivecic.rveivrseiaveesi.nbhlvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseivecic.rveivrseiaveesi.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseivecic.rveivrseiaveesi.plqjhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseivei.cvrievsresivesi.fshxqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseivei.cvrievsresivesi.fzcftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseivei.cvrievsresivesi.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseivei.cvrievsresivesi.lwxxqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseivei.cvrievsresivesi.mravkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseivei.cvrievsresivesi.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseivei.cvrievsresivesi.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseivei.cvrievsresivesi.ofburn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseveci.cvrievsreaveesi.exrjwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseveci.cvrievsreaveesi.guxqvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseveci.cvrievsreaveesi.hhksfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseveci.cvrievsreaveesi.mcbprf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseveci.cvrievsreaveesi.mdaxpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseveci.cvrievsreaveesi.mhnved.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseveci.cvrievsreaveesi.mravkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseveci.cvrievsreaveesi.ofburn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseveci.cvrievsreaveesi.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseveci.cvrievsreaveesi.poaixv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseveci.cvrievsreaveesi.qnomqo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecsevei.vcirvesersvesi.klgjib.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecsevei.vcirvesersvesi.kxcepn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecsevei.vcirvesersvesi.mcbprf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecsevei.vcirvesersvesi.oycpxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceiveci.vivriaveesi.cjysqjj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceiveci.vivriaveesi.coflya.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceiveci.vivriaveesi.dhwynj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceiveci.vivriaveesi.wdtsjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceiveci.vivriaveesi.zliboyp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceivei.vivsrivesi.abzcr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceivei.vivsrivesi.bspybm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceivei.vivsrivesi.cjysqjj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceivei.vivsrivesi.cntxao.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceivei.vivsrivesi.htixjser.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceivei.vivsrivesi.kpblio.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceivei.vivsrivesi.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceivei.vivsrivesi.sejmqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceivei.vivsrivesi.shaot.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceivei.vivsrivesi.xvtayq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceivei.vivsrivesi.yqzemo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceveci.vivsrveesi.afevzf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceveci.vivsrveesi.ajvrm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceveci.vivsrveesi.bjexfe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceveci.vivsrveesi.bspybm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceveci.vivsrveesi.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceveci.vivsrveesi.dhwynj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceveci.vivsrveesi.ehngpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceveci.vivsrveesi.hyfxgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceveci.vivsrveesi.mkpiab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceveci.vivsrveesi.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceveci.vivsrveesi.xudixq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsseccevei.vivseresi.badkfs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsseccevei.vivseresi.bdbbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsseccevei.vivseresi.bzfdtw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsseccevei.vivseresi.cpgspk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsseccevei.vivseresi.dauexk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsseccevei.vivseresi.huaxiano.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsseccevei.vivseresi.msiesya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsseccevei.vivseresi.pkilix.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsseccevei.vivseresi.rsfcmb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsseccevei.vivseresi.sctgkq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsseccevei.vivseresi.upuphone.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200042052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsseccevei.vivseresi.xudixq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsseccevei.vivseresi.yanwen.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200042054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsseccevei.vivseresi.yhitbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivecic.eivrseiaveesi.ajvrm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivecic.eivrseiaveesi.mkpiab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivecic.eivrseiaveesi.ubdjag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivecic.eivrseiaveesi.ufihby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivecic.eivrseiaveesi.vfchrz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivecic.eivrseiaveesi.vozep.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivecic.eivrseiaveesi.wbziul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivecic.eivrseiaveesi.wetot.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivecic.eivrseiaveesi.xvtayq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivei.cvevsresivesi.benefitted.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivei.cvevsresivesi.bporry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivei.cvevsresivesi.dlnxzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivei.cvevsresivesi.dpqshv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivei.cvevsresivesi.hfoesk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivei.cvevsresivesi.kpblio.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivei.cvevsresivesi.msiesya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivei.cvevsresivesi.quvhdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivei.cvevsresivesi.wetot.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200042073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivei.cvevsresivesi.xvtayq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivei.cvevsresivesi.zjsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseveci.cvevsreaveesi.bspybm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseveci.cvevsreaveesi.dauexk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseveci.cvevsreaveesi.digitize.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200042078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseveci.cvevsreaveesi.fgcew.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseveci.cvevsreaveesi.fksiud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseveci.cvevsreaveesi.jdqomw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseveci.cvevsreaveesi.lenorv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseveci.cvevsreaveesi.msiesya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseveci.cvevsreaveesi.ssrpsl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseveci.cvevsreaveesi.tvdoqx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseveci.cvevsreaveesi.upuphone.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200042086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseveci.cvevsreaveesi.wdtsjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseveci.cvevsreaveesi.xlrppx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseveci.cvevsreaveesi.ytvuml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecsevei.vciesersvesi.badkfs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecsevei.vciesersvesi.bspybm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecsevei.vciesersvesi.ckhnlk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecsevei.vciesersvesi.dafenghao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecsevei.vciesersvesi.qskgtg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecsevei.vciesersvesi.rsfcmb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecsevei.vciesersvesi.sctgkq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecsevei.vciesersvesi.ubdjag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecsevei.vciesersvesi.vfchrz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecsevei.vciesersvesi.vozep.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecsevei.vciesersvesi.wgipfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecsevei.vciesersvesi.wxnyfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecsevei.vciesersvesi.ytvuml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"videysrhof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200042103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vidhyaclinic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200042104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vidmmbeabw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200042105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.ejvyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.dy1nam.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.ejvyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.ejvyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.gpik9c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.ejvyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.dy1nam.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.ejvyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.dy1nam.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.dy1nam.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.gpik9c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.ejvyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.dy1nam.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.gpik9c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.ejvyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.gpik9c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.dy1nam.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.ejvyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.gpik9c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.dy1nam.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.ejvyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.gpik9c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.ejvyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.gpik9c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.dy1nam.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.ejvyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecaaaaesi.visecevvasseaors.2124458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200043252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecaaaaesi.visecevvasseaors.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200043253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecaaaaesi.visecevvasseaors.uxhejc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecaaaasi.visaecevvssaosr.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200043255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecaaaasi.visaecevvssaosr.fodxlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecaaaosi.visaecevvssaosr.ebltts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecaaaosi.visaecevvssaosr.hxsyjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecaaaosi.visaecevvssaosr.uxhejc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecaaeaesi.viscaasseaors.fodxlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecaaeaesi.viscaasseaors.ivupqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecaaeaesi.viscaasseaors.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecaaeasi.visaeassaosr.bcjgin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecaaeasi.visaeassaosr.ftrdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecaaeosi.visavassaosr.ebltts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecaaeosi.visavassaosr.uxhejc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecaaeosi.visavassaosr.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaaaevier.vecevvasceaeroi.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200043268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaaaevier.vecevvasceaeroi.hxsyjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaaaevier.vecevvasceaeroi.pukrre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaaaevier.vecevvasceveroi.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200043271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaaaevier.vecevvasceveroi.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200043272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaaaevier.vecevvasceveroi.hxsyjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaaaevier.vecevvasceveroi.hzwrnd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaaaevier.vecevvasceveroi.ivupqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaaavier.vaecevvcsaeoir.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200043276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaaavier.vaecevvcsaeoir.dlsefg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaasvier.vaecevvcsveoir.ivupqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaasvier.vaecevvcsveoir.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaeaevier.vcaasceaeroi.2355587.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200043280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaeaevier.vcaasceaeroi.bcjgin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaeaevier.vcaasceaeroi.ebltts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaeaevier.vcaasceaeroi.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaeaevier.vcaasceveroi.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200043284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaeaevier.vcaasceveroi.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaeaevier.vcaasceveroi.ivupqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaesvier.vasacsveoir.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200043287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaesvier.vasacsveoir.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200043288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaesvier.vasacsveoir.ebltts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaesvier.vasacsveoir.uxhejc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaesvier.vasacsveoir.wtkiwf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaaaees.visecevvasneaire.2124458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200043292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaaaees.visecevvasneaire.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200043293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaaaees.visecevvasneaire.fodxlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaaaees.visecevvasneaire.hxsyjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaaaees.visecevvasneeire.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaaaes.visaecevvnsaier.gzovnq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200043297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaaaes.visaecevvnsaier.hxsyjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaaves.visaecevvnseier.coflya.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaaves.visaecevvnseier.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaaves.visaecevvnseier.uxhejc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaeaees.viscaasneaire.hxsyjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaeaees.viscaasneaire.pyseum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaeaees.viscaasneaire.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaeaees.viscaasneaire.wtkiwf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaeaees.viscaasneeire.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200043306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaeaees.viscaasneeire.bcjgin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaeaees.viscaasneeire.uxhejc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaeaees.viscaasneeire.wtkiwf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaeaes.visaeansaier.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200043310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaeaes.visaeansaier.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaeves.visasanseier.2355587.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200043312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaeves.visasanseier.hxsyjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieisecaevier.vccavceaeoi.benxhh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200043314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieisecaevier.vccavceaeoi.dvtdev.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200043315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieisecaevier.vccavceaeoi.puowqu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200043316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieisecaevier.vccavceveoi.ceedca.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200043317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieisecaevier.vccavceveoi.samckkf.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200043318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieisecsvier.vasvceveoi.lyjtug.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200043319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieisecsvier.vasvceveoi.t9f0v91.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200043320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieivsaaees.visccaaneaie.hmfhsq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200043321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieivsaaees.visccaaneaie.lq0cebn.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200043322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieivsaaees.visccaaneeie.gmveprp.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200043323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieivsaaes.visaeaneaie.lqslas.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200043324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieivsaaes.visaeaneaie.qxy0g3r.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200043325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieivsaaes.visaeaneaie.ulcodn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200043326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieivsaaes.visaeaneaie.xvaunoh.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200043327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.ejvyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.gpik9c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.ejvyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.dy1nam.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.gpik9c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.gpik9c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.ejvyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.gpik9c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.dy1nam.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.gpik9c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.dy1nam.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.gpik9c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.dy1nam.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.ejvyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.gpik9c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.dy1nam.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.ejvyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.dy1nam.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.ejvyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.ejvyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.gpik9c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.dy1nam.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.dy1nam.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.gpik9c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.dy1nam.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.ejvyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.dy1nam.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.ejvyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.gpik9c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieosreinneiv.vsoersioivrrennvxmrvi.abkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieosreinneiv.vsoersioivrrennvxmrvi.alxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieosreinneiv.vsoersioivrrennvxmrvi.avghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viesaceaesi.visccavseaos.gavarzl.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200044558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viesaceaesi.visccavseaos.hwej2s6.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200044559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viesaceaesi.visccavseaos.mtfjgc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200044560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viesaceaesi.visccavseaos.pnctmk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200044561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viesaceaesi.visccavseaos.wopjkh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200044562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viesaceaesi.visccavseaos.xotcze.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viesaceasi.visaevseaos.5y4gj2a.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200044564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viesaceasi.visaevseaos.benxhh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200044565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viesaceosi.visavvseaos.dovxqw.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200044566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viesaceosi.visavvseaos.uflpeu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200044567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viesaceosi.visavvseaos.xhtarn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200044568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vietgahp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200044569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viettel-com-dot-c2c01-531c7.uc.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200044570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"view-power-share-file.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200044571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"view-power-share-file.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200044572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"view-shared-file-folder-login.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200044573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"view.campanhasbradesco.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200044574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viewdocs.drizzlead.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200044575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viewsnet.jp.kutcim.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200044576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viewthescreen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200044577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vifkorvdrx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200044578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vihted-informing.897751.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viirtualconfi.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200044580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vijomitpsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200044581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vikinghalden.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200044582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vimsadhytm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200044583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viniocure.visorcsiercvxarevi.eaplgjq.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viniocure.visorcsiercvxarevi.vtwwkwu.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-delivery.000457888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-delivery.43435556.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-delivery.8900092.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-informing.5566432.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.15a2.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.51hiyd.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200044591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.aemine.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.akpool.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200044593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.apurva.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200044594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.asndh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.boxmon.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.buzzfr.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.camarqq.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200044598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.charloe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.cijilu.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.datais.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200044601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.dgrwy1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.diyang.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.dwqaz.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.enses.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.fanye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.giftie.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200044607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.gunwa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.hbsoic.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200044609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.hiyuu.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200044610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.iamhindu.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200044611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.inmeng.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.ipnio.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.irritum.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.joust.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200044615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.kasqq.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200044616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.lajiao3.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.muqing.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.nivdal.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.nobie.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200044620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.nrs10.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.nzyoga.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200044622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.obras.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200044623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.optins.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.osbon.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.parag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.pqoe.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.qqmzan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.qqraja.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200044629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.qs23.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.rainm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.reify.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200044632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.rhcsmk.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.ruyada.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.safessl.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200044635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.sanbds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.scripter.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.sefuli.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.seshu.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200044639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.sfse.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200044640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.shsdh1.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.slantix.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.somr4.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200044643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.spturate.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.stakeo.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200044645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.starpro.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200044646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.suduzaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.tduk.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.tertip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.tianbei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.tyzsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.viewsy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.wizb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.wompus.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.yokka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.yrsmidi.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200044656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.zarbwl.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.zhangsq.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gkk219.wompus.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-id002c.anzijie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-id002c.canam.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200044661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-lzlxo.rlsbb.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-hj.order9356.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200044663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.eholot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.hycdgx.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.wocao0.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-purchase.570324.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-shop.44125.fun"; content:"Host"; http_header; classtype:attempted-recon; sid:200044668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-viuy.order618.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200044669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted.3298211.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted.sprzedaz.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200044671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vintedform-inform.1221235.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vintedinfo-shipment.564348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vintedshop.3542321.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vintedsite-informing.2411154.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioerescsnv.vsoersroirevxarevi.bkiljbe.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioerescsnv.vsoersroirevxarevi.ctuhgfk.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioerescsnv.vsoersroirevxarevi.nulhvqm.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioerescsnv.vsoersroirevxarevi.ovuydax.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioerescsnv.vsoersroirevxarevi.pbeozzc.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioerescsnv.vsoersroirevxarevi.poywtcc.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioesreorceosnv.vsoersoecsioirescvi.iuwqqxo.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioesreosnv.vsoersioirescvi.dtgskgr.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioesreosnv.vsoersioirescvi.mbjalki.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioesreosnv.vsoersioirescvi.zmwmbck.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioesrerceosnv.vsoersoecsivxarerescvi.cnufsqh.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioesrerceosnv.vsoersoecsivxarerescvi.fzjyqpy.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioesrescsnv.vsoersroirescvi.qtroqhr.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioesrescsnv.vsoersroirescvi.zikhocp.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioesresorcecsnv.vsoersoecsroirescvi.vtwwkwu.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioesresorcecsnv.vsoersoecsroirescvi.yvlpjam.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioesresrcecsnv.vsoersoecsrvxarerescvi.qmvhsgu.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioesresrcecsnv.vsoersoecsrvxarerescvi.ranzilm.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioesresrcecsnv.vsoersoecsrvxarerescvi.thnoceg.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.arowal.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.bomgwz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.bypiqw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.ciuwoo.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.cmoqdm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.egrhtq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.eickib.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.fjfuni.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.fkbwav.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.hbzhrq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.hilrzx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.jlxkma.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.jvahcx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.khlzjd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.lndzay.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.lxxdeq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.lyiqnd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.mifikv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.mqvjkr.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.nbzllz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.ntdght.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.ovpzzh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.pdzcxc.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.qigfcj.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.rqrpjt.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.rzyssw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.sfqlok.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.upblku.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.wfzola.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.wgkngu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.yabztv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.yvzlne.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.zcyttz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.ziehxi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.zuaswx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.arowal.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.bypiqw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.cmoqdm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.fjfuni.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.fkbwav.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.gbaluw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.gkaxhu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.gykmlg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.hbzhrq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.hqnjab.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.jvahcx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.khlzjd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.lndzay.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.lxxdeq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.lyiqnd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.mhlvfi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.mqvjkr.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.nbzllz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.ntdght.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.ovpzzh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.pdzcxc.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.podujg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.rdinpk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.sfqlok.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.upblku.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.uuppfm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.wgkngu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.whdeeh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.xkpjpw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.xutdbc.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.yabztv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.zcyttz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.ziehxi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.zuaswx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.arowal.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.asciqo.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.bypiqw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.cmoqdm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.eickib.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.fjfuni.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.gpaqia.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.hbzhrq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.jvahcx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.khlzjd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.lndzay.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.lyiqnd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.mbjhhd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.mifikv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.mqvjkr.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.nbzllz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.ntdght.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.ovpzzh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.podujg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.qigfcj.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.rdinpk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.rqrpjt.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.sfqlok.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.ukpvop.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.upblku.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.wgkngu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.whdeeh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.xkpjpw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.yabztv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.yvzlne.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.ziehxi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.arowal.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.cmoqdm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.eickib.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.fjfuni.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.fkbwav.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.gyyiwk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.hbzhrq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.hqnjab.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.jlxkma.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.khlzjd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.ksbgin.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.lndzay.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.lyiqnd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.mqvjkr.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.nbzllz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.ntdght.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.ovpzzh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.pdzcxc.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.qigfcj.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.rdinpk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.rqrpjt.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.rzyssw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.sfqlok.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.ukpvop.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.upblku.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.wgkngu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.xkpjpw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.yabztv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.zdknwh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.ziehxi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.zkxahi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.zuaswx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.bomgwz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.bypiqw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.ciuwoo.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.cmoqdm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.eickib.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.fjfuni.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.fkbwav.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.hqnjab.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.jvahcx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.khlzjd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.ksbgin.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.lndzay.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.nbzllz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.ovpzzh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.pdzcxc.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.qigfcj.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.rdinpk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.ukpvop.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.upblku.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.uuppfm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.wfzola.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.wgkngu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.whdeeh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.xkpjpw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.yabztv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.yvzlne.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.ziehxi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.zuaswx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.arowal.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.bomgwz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.bypiqw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.cufjaj.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.eickib.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.fdtieg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.fjfuni.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.gykmlg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.hbzhrq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.hqnjab.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.jlxkma.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.jvahcx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.khlzjd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.ksbgin.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.lndzay.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.mifikv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.mqvjkr.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.nbzllz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.ntdght.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.ovpzzh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.pdzcxc.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.pvqbdr.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.rdinpk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.rqrpjt.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.rzyssw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.sfqlok.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.upblku.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.wfzola.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.whdeeh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.xkpjpw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.xqjgyc.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.yabztv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.yvzlne.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.zdknwh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.zuaswx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.arowal.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.bomgwz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.bypiqw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.cmoqdm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.cufjaj.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.eickib.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.fjfuni.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.gykmlg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.hbzhrq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.hqnjab.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.jqlcwt.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.jvahcx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.khlzjd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.ksbgin.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.mqvjkr.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.nbzllz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.ntdght.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.ovpzzh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.pdzcxc.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.pvqbdr.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.qigfcj.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.rdinpk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.rqrpjt.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.sfqlok.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.ukpvop.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.upblku.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.wfzola.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.wgkngu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.whdeeh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.yabztv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.yvzlne.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.ziehxi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.zuaswx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.accunn.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.arowal.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.bomgwz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.cmoqdm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.eickib.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.fkbwav.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.gbaluw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.gykmlg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.hbzhrq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.jvahcx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.lndzay.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.lyiqnd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.nbzllz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.ntdght.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.ovpzzh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.pdzcxc.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.qigfcj.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.rdinpk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.sfqlok.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.ukpvop.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.wgkngu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.whdeeh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.xkpjpw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.yabztv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.ziehxi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.zuaswx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200044948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viosreosnv.vsoersioirevxarevi.hymzwrr.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viosreosnv.vsoersioirevxarevi.ouqcrce.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200044950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vipfbtools.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200044951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viqzlfnvsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200044952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vireqoufyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200044953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"virted-pl-fi551.zenpond.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200044954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"virtual.labdigbdbqapb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200044955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"virtual.labdigbdbstgpb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200044956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"virtualnetbrasil.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200044957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"virtualofertastramontina.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200044958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"virvlxtpzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200044959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vis-stort.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200044960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaaaeveeccsvcrcaorsai.vieissacirvoeainicrcivsioir.dzwrms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaaaeveeccsvcrcaorsai.vieissacirvoeainicrcivsioir.edziyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaaaeveeccsvcrcaorsai.vieissacirvoeainicrcivsioir.evyqhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaaaeveeccsvcrcaorsai.vieissacirvoeainicrcivsioir.gyzt808.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaaaeveeccsvcrcaorsai.vieissacirvoeainicrcivsioir.oybdmv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaaaevesccvccrasoria.viiessvaciraoecinivrsiiori.p8qjo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaaieveecsevcrcaorsai.vieissvcioeoacincvrsiiori.loxcvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaaievescveccrasoria.viiessvacioeocvinsiroiri.0633348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaavesevccascri.orvaisvieaseccivsoioinrrii.nhejxw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.xuacoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200045000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.owbxts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.mjfemh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200045048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.urgggv.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200045065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.owbxts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaeavcececsvrcasii.viiorsaervesaiccvnsiovreri.bzlrqb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaeavcececsvrcasii.viiorsaervesaiccvnsiovreri.mylnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200045161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200045298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200045434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200045571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevececsvcarsi.viisvioreaeccvssiornveri.ryygdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.mjfemh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200045766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevscecvcasri.viisvaiorecevsisornveri.mzzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevscecvcasri.viisvaiorecevsisornveri.tlocgg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.owbxts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.cckrka.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200045863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.mjfemh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200045871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.yxpfzh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.peshlh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200045910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visamasecoocsoersd.moasecsecsccrerd.btqhqpo.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200045930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200045983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200046119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200046256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200046393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200046529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200046666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200046803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200046940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.obekup.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200047038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.vnbmwi.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200047054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.obekup.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200047074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.sxmerd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200047116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.cckrka.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200047132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200047215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200047352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200047489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200047626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visccaaaeier.vaecevvasaeoir.6hu6jz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visccaaaeier.vaecevvasaeoir.qlkmeq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visccaaaeier.vaecevvasaeoir.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visccaavier.vaeecevvasoir.2124458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200047714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visccaavier.vaeecevvasoir.evzxzh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visccaavier.vaeecevvasoir.fodxlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visccaeaeier.vacaasaeoir.2355587.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200047717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visccaeaeier.vacaasaeoir.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200047718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visccaeaeier.vacaasaeoir.hzwrnd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visccaeaeier.vacaasaeoir.ivupqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visccaevier.vaevaasoir.dlsefg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visccaevier.vaevaasoir.ivupqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viscvaaaeier.vaecevvasveoir.2124458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200047723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viscvaaaeier.vaecevvasveoir.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viscvaaaeier.vaecevvasveoir.uxhejc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viscvaeaeier.vacaasveoir.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200047726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viscvaeaeier.vacaasveoir.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200047727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viscvaeaeier.vacaasveoir.dlsefg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viscvaeaeier.vacaasveoir.fodxlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viscvaeaeier.vacaasveoir.ivupqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viscvaeaeier.vacaasveoir.pdmvfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viscvaevier.vasvavsoir.gzovnq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200047732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viscvaevier.vasvavsoir.lxbnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viscvaevier.vasvavsoir.pdmvfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viscvaevier.vasvavsoir.wwepwc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viseccaaeier.vaccacaeoi.2m5f9l3.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200047736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viseccaaeier.vaccacaeoi.iehamba.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200047737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viseccavier.vaevcaeoi.eowzeh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200047738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viseccavier.vaevcaeoi.momhdk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200047739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viseccavier.vaevcaeoi.opulwar.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200047740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viseccavier.vaevcaeoi.tkhotm.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200047741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viseeseosieecarci.vcssecsieoasoceneaseocieusoccesoesoc.dekl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200047742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viseiocai.vscsaeiisoc.qxkahc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viseioscai.vscsaieeicso.stjjjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viseocai.vscsaeisoc.mgjuxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viseoscai.vscsaeeicso.stjjjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visescai.vscsaeeiso.mojnlk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visescai.vscsaeeiso.qxkahc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viseseoieoccai.vsscessoaceeuiosscoc.gnpais.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visevcsvier.vasvcveoi.hmxwtb.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200047750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visioncenterss.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200047751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visioneidentificazione.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200047752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissaeavecececcsvrcrasii.iviiorsiaerveisaiccivnsiovreri.gyaexz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissaeivececescevrcrasii.iviiorsiveoeaisccvsiinorveri.s1niu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissveasececvcccarsri.viiisvioraiaercvissiioirnveri.fshxqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissveieececsvcecrarsi.iviisiorviaeoccisvsioirnveri.jxavqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissveieececsvcecrarsi.iviisiorviaeoccisvsioirnveri.usyxh3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissveieececsvcecrarsi.iviisiorviaeoccisvsioirnveri.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvesvececcacsir.rvisiviaciorviseiorisnverii.rtvsct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.nmlubc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvaaeeesccvccrasoria.viiessvaciraoccinivrsiiori.djkvdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvaeesevccascri.orvaisvieascccivsoioinrrii.ojvntr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvaieeescveccrasoria.viiessvaciococvinsiroiri.bsvdfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvaiesevcceacrsior.avisievsacciovosiinorrii.70x8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visveaeaverrei.vivacrvecoisec.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visveaeaverrei.vivacrvecoisec.gzj8007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200047766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visveascecvccarsi.viisvioraaercvssiiornveri.slx8h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visveseavsrrei.vivaervecsisec.acucbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visveseavsrrei.vivaervecsisec.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visveseavsrrei.vivaervecsisec.kxmmvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visveseavsrrei.vivaervecsisec.zbjyiw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvceccasir.visivaciorvseiorsnveri.string97.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200047772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvceccasir.visivaciorvseiorsnveri.xubnkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200047774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200047818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200047904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200047948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200048033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200048078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200048169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200048215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200048306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200048351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200048437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200048483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.vads.fun"; content:"Host"; http_header; classtype:attempted-recon; sid:200048545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200048569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200048614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200048704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200048751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200048834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.herbertweb.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200048876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200048880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200048964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200048999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200049005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200049135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200049266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.oads.fun"; content:"Host"; http_header; classtype:attempted-recon; sid:200049295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vital1.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vitaltours.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200049357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivaaeesccvcrasoia.viessvacraoccnivrsiori.swixid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivacaces.visceacaie.wynkjx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200049359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivaeesvccasri.ovaisveascccvsoionrri.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivaeesvccasri.ovaisveascccvsoionrri.ouswzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivaeesvccasri.ovaisveascccvsoionrri.yfnvfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivaescvcasi.visvaraccivsior.mu1iskm5.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200049363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivaieescvecrasoia.viessvacococvnsirori.edziyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivaiesvccearsio.avisevsaccovosinorri.eqmmzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivaiesvccearsio.avisevsaccovosinorri.mxmspo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivasevccasir.voiasvaecsvscioornri.zxj4029.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200049386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200049433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200049480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200049527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivccaaaes.visvecevvasaier.fodxlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivccaaaes.visvecevvasaier.likduf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivccaaees.viasveeaaaser.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivccaaees.viasveeaaaser.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivccaaees.viasveeaaaser.ebltts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivccaaes.visveecevvaser.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivccaaes.visveecevvaser.ivupqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivccaaes.visveecevvaser.mddqbt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivccaeaes.visvcaasaier.dlsefg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivccaeaes.visvcaasaier.ebltts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivccaeaes.visvcaasaier.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivccaeaes.visvcaasaier.wtkiwf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivccaees.visveaaaser.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200049587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200049634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200049681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200049727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200049771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200049772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200049781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200049791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200049830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200049842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200049844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200049866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200049874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200049876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200049884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200049886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200049890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200049891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.upfi.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200049904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200049916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcseecei.viveaaevesi.gbxbjo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcseecei.viveaaevesi.mgfxpv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcseecei.viveaaevesi.ojabvb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcseecei.viveaaevesi.peqrlu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcseecei.viveaaevesi.pfkndl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcseecei.viveaaevesi.qbkymz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcseecei.viveaaevesi.qsgdnx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcseecei.viveaaevesi.qyoqyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcseecei.viveaaevesi.uhdxmb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcseecei.viveaaevesi.vucabx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcseecei.viveaaevesi.vusnur.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcseecei.viveaaevesi.zktobi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsevei.vivesavesi.difkhu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsevei.vivesavesi.epmgtc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsevei.vivesavesi.ifpdph.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsevei.vivesavesi.lcuqbc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsevei.vivesavesi.mgfxpv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsevei.vivesavesi.oaimcs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsevei.vivesavesi.pddjuu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsevei.vivesavesi.vnsscq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsevei.vivesavesi.vusnur.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsevei.vivesavesi.wffxjj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsevei.vivesavesi.wylftw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsevei.vivesavesi.yjnkya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsevei.vivesavesi.zktobi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsieecei.viveiaaevesi.dzniib.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsieecei.viveiaaevesi.fthjtm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsieecei.viveiaaevesi.ifpdph.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsieecei.viveiaaevesi.nkgnxu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsieecei.viveiaaevesi.nskxef.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsieecei.viveiaaevesi.pddjuu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsieecei.viveiaaevesi.ryogde.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsieecei.viveiaaevesi.sbonjn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsieecei.viveiaaevesi.yjnkya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsieecei.viveiaaevesi.ylvgii.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsieecei.viveiaaevesi.zenagx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsieecei.viveiaaevesi.ziqmtw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsieecei.viveiaaevesi.zrmusc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsievei.vivesiavesi.frghvs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsievei.vivesiavesi.gbxbjo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsievei.vivesiavesi.lqonrt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsievei.vivesiavesi.mgfxpv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsievei.vivesiavesi.ntmdlo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsievei.vivesiavesi.nyapck.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsievei.vivesiavesi.obnjjr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsievei.vivesiavesi.peqrlu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsievei.vivesiavesi.pfxtar.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsievei.vivesiavesi.pxwxmw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsievei.vivesiavesi.stghfe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsievei.vivesiavesi.vixxvg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsievei.vivesiavesi.wssjge.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsievei.vivesiavesi.yoltyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsievei.vivesiavesi.zlppsf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.apoljj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.axbhie.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.cbargn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.cpclxs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.fjdayb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.hcnqqk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.jzemci.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.lqonrt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.mgfxpv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.nqawww.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.ojabvb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.peqrlu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.pruuwp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.qytbke.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.sbonjn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.yoltyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.yyciai.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.zhafla.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.ziuzyk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesvei.vicvreesavesi.cnzlue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesvei.vicvreesavesi.dyjnbb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesvei.vicvreesavesi.hcnqqk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesvei.vicvreesavesi.jzemci.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesvei.vicvreesavesi.nqawww.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesvei.vicvreesavesi.peqrlu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesvei.vicvreesavesi.qbkymz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesvei.vicvreesavesi.qytbke.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesvei.vicvreesavesi.uhdxmb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesvei.vicvreesavesi.vjyswj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesvei.vicvreesavesi.vnsscq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesvei.vicvreesavesi.xmigxe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesvei.vicvreesavesi.ylvgii.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesvei.vicvreesavesi.yyciai.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesvei.vicvreesavesi.zhafla.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreiseecei.cvrieveiaaevesi.fbgnzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreiseecei.cvrieveiaaevesi.fshxqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreiseecei.cvrieveiaaevesi.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreiseecei.cvrieveiaaevesi.nyzjio.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreiseecei.cvrieveiaaevesi.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreisevei.vcirveesiavesi.fshxqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreisevei.vcirveesiavesi.iktggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreisevei.vcirveesiavesi.poaixv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsseceecei.viveaaesi.fgmlde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsseceecei.viveaaesi.fynqxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsseceecei.viveaaesi.ghqphy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsseceecei.viveaaesi.laeyhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsseceecei.viveaaesi.mhnved.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsseceecei.viveaaesi.pwnccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsseceecei.viveaaesi.qnomqo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsseceecei.viveaaesi.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecevei.vivesavi.iktggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecevei.vivesavi.lrtzrp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecevei.vivesavi.poaixv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecevei.vivesavi.qjtfvg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecieecei.viveievesi.fiwzrb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecieecei.viveievesi.gjrbgg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecieecei.viveievesi.ltineb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecieecei.viveievesi.mdaxpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecieecei.viveievesi.owqbbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecievei.vivesiesi.fshxqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecievei.vivesiesi.kxcepn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecievei.vivesiesi.lhewuf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesecei.vcieeaaevesi.abzcr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesecei.vcieeaaevesi.balaet.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesecei.vcieeaaevesi.benefitted.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesecei.vcieeaaevesi.bjexfe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesecei.vcieeaaevesi.bporry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesecei.vcieeaaevesi.bzfdtw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesecei.vcieeaaevesi.ccvjar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesecei.vcieeaaevesi.cntxao.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesecei.vcieeaaevesi.digitize.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesecei.vcieeaaevesi.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesecei.vcieeaaevesi.ehngpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesecei.vcieeaaevesi.vfchrz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesecei.vcieeaaevesi.wgipfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesecei.vcieeaaevesi.xlrppx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesecei.vcieeaaevesi.yanwen.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200050052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesecei.vcieeaaevesi.ymwfnw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesvei.vicvesavesi.dhwynj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesvei.vicvesavesi.hfoesk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesvei.vicvesavesi.msiesya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesvei.vicvesavesi.upuphone.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesvei.vicvesavesi.wbziul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesvei.vicvesavesi.wingfh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesvei.vicvesavesi.xlrppx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesvei.vicvesavesi.zjsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreiseecei.cveveiaaevesi.cipqzd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreiseecei.cveveiaaevesi.digitize.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreiseecei.cveveiaaevesi.ehxsyt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreiseecei.cveveiaaevesi.fgcew.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreiseecei.cveveiaaevesi.hfoesk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreiseecei.cveveiaaevesi.mkpiab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreiseecei.cveveiaaevesi.sctgkq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreiseecei.cveveiaaevesi.sejmqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreiseecei.cveveiaaevesi.ttxupv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreiseecei.cveveiaaevesi.upuphone.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200050071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreiseecei.cveveiaaevesi.wbvazy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreiseecei.cveveiaaevesi.wgipfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreiseecei.cveveiaaevesi.xaeuyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreiseecei.cveveiaaevesi.xudixq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreiseecei.cveveiaaevesi.yhitbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreiseecei.cveveiaaevesi.zliboyp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreisevei.vcieesiavesi.abzcr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreisevei.vcieesiavesi.ajvrm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreisevei.vcieesiavesi.bporry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreisevei.vcieesiavesi.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreisevei.vcieesiavesi.hfoesk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreisevei.vcieesiavesi.rsfcmb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreisevei.vcieesiavesi.tvdoqx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcvaaaes.visvecevvaseier.2124458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcvaaaes.visvecevvaseier.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcvaaes.visvsecevveser.fodxlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcvaaes.visvsecevveser.ftrdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcvaaes.visvsecevveser.pdmvfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcvaeaes.visvcaaseier.2124458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcvaeaes.visvcaaseier.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcvaeaes.visvcaaseier.pdmvfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcvaeaes.visvcaaseier.txvcqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcvaees.visvsaaeser.fodxlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcvaees.visvsaaeser.hzwrnd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcvaees.visvsaaeser.txvcqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcvaees.visvsaaeser.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveaaverei.vivcrvcoie.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveaaverei.vivcrvcoie.ayqtuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200050115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200050116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200050117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200050122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200050127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200050137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200050159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200050177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200050183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200050190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200050213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200050221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200050223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200050231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200050234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200050237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.upfi.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200050251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200050262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200050288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200050335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200050383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200050431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivesavsrei.vivervcsie.zxj6008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivesvcasi.visvaccvsior.cvqubj.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200050462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200050481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200050555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.cairaoke.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200050665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200050683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200050785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200050833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200050881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200050958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200051044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200051086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvceasi.visvacovsior.bhsgjj.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200051173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvceasi.visvacovsior.lnjaaq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200051174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivosaaeeei.viccrvcooier.wndxgg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivosaaseei.vicervcosier.ooqrml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.fmttqq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.obekup.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200051224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.sxmerd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200051234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.vnbmwi.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200051241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.obekup.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200051294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.peshlh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200051296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200051368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200051505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200051642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200051779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200051916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.xuacoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200052475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.mjfemh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200052489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.xuacoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200052543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.yxpfzh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsciveci.vivseiaveesi.epmgtc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsciveci.vivseiaveesi.fthjtm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsciveci.vivseiaveesi.fyyfxo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsciveci.vivseiaveesi.hcnqqk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsciveci.vivseiaveesi.qyoqyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsciveci.vivseiaveesi.qytbke.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsciveci.vivseiaveesi.vixxvg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsciveci.vivseiaveesi.xioxfp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsciveci.vivseiaveesi.ygrkwy.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscreisveci.vcirveseiaveesi.fgmlde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscreisveci.vcirveseiaveesi.iktggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscreisveci.vcirveseiaveesi.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscreisveci.vcirveseiaveesi.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscreisveci.vcirveseiaveesi.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscreisveci.vcirveseiaveesi.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscreisvei.vicvrseesivesi.fiwzrb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscreisvei.vicvrseesivesi.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscreisvei.vicvrseesivesi.rchahv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscreisvei.vicvrseesivesi.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.aiinpw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.apoljj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.dyjnbb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.fjdayb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.hcnqqk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.jpxnnz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.kzdaec.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.lcuqbc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.lvuojw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.nkgnxu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.ntmdlo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.ojabvb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.peqrlu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.phskmc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.qbkymz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.qytbke.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.sewril.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.uhdxmb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.vnsscq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.vunivt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.wffxjj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.wssjge.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.yjnkya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevsei.vivcsreesvesi.difkhu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevsei.vivcsreesvesi.fmdodt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevsei.vivcsreesvesi.hcnqqk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevsei.vivcsreesvesi.ntmdlo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevsei.vivcsreesvesi.prfshi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevsei.vivcsreesvesi.rouqjs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevsei.vivcsreesvesi.sznube.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevsei.vivcsreesvesi.trzfav.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevsei.vivcsreesvesi.vnsscq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevsei.vivcsreesvesi.vucabx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevsei.vivcsreesvesi.wssjge.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevsei.vivcsreesvesi.ylvgii.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevsei.vivcsreesvesi.zenagx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisveci.vcieseiaveesi.abzcr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisveci.vcieseiaveesi.cpgspk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisveci.vcieseiaveesi.fksiud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisveci.vcieseiaveesi.hfoesk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisveci.vcieseiaveesi.jtuet.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisveci.vcieseiaveesi.mavbpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisveci.vcieseiaveesi.rsfcmb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisveci.vcieseiaveesi.sejmqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisveci.vcieseiaveesi.upuphone.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200052885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisveci.vcieseiaveesi.urekwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisveci.vcieseiaveesi.wdtsjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisveci.vcieseiaveesi.xudixq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisveci.vcieseiaveesi.ytvuml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisveci.vcieseiaveesi.zblgxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisvei.vicveesivesi.balaet.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisvei.vicveesivesi.cipqzd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisvei.vicveesivesi.fvhuee.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisvei.vicveesivesi.lenorv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisvei.vicveesivesi.mkpiab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisvei.vicveesivesi.mqiwux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisvei.vicveesivesi.runjin004.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisvei.vicveesivesi.wetot.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisvei.vicveesivesi.wetot.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200052899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisvei.vicveesivesi.xlrppx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisvei.vicveesivesi.yhitbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevseci.vicveeaveesi.balaet.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevseci.vicveeaveesi.bjexfe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevseci.vicveeaveesi.coflya.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevseci.vicveeaveesi.hyfxgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevseci.vicveeaveesi.jdqomw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevseci.vicveeaveesi.jtuet.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevseci.vicveeaveesi.upuphone.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200052908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevseci.vicveeaveesi.wetot.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevseci.vicveeaveesi.wgipfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevseci.vicveeaveesi.wxnyfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevseci.vicveeaveesi.xxdjik.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevsei.vivcsesvesi.bdbbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevsei.vivcsesvesi.benefitted.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevsei.vivcsesvesi.bspybm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevsei.vivcsesvesi.ccvjar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevsei.vivcsesvesi.craycraft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevsei.vivcsesvesi.dyugxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevsei.vivcsesvesi.evyqhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevsei.vivcsesvesi.fvqetn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevsei.vivcsesvesi.mqiwux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevsei.vivcsesvesi.pkilix.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevsei.vivcsesvesi.tvdoqx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevsei.vivcsesvesi.upuphone.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200052924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevsei.vivcsesvesi.wbziul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevsei.vivcsesvesi.wehqxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevsei.vivcsesvesi.yavkol.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevsei.vivcsesvesi.ymwfnw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevsei.vivcsesvesi.ytvuml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevsei.vivcsesvesi.zliboyp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200053120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.cckrka.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200053208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.mjfemh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200053216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.owbxts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.owbxts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.sxmerd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200053329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.vnbmwi.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200053336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.obekup.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200053356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.xuacoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200053407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.mjfemh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200053454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.obekup.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200053458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.vnbmwi.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200053473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.yxpfzh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseaasi.mfwrsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseaasi.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.mfwrsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200053502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200053550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200053598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200053646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200053673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsiecaiecsn.viscaieaeeivsei.yetbrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsiecaieosn.visceieaeeivsei.cyrvcc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsiecaieosn.visceieaeeivsei.tcpduc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsiecioesn.visecaeeeivsei.cyrvcc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsiecioesn.visecaeeeivsei.tcpduc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsieiacesn.visacaieeivsei.cyrvcc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200053682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200053726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200053815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200053862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200053950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200053994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200053995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200053999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200054082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.131452.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200054083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.fanyedong.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200054121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.vads.fun"; content:"Host"; http_header; classtype:attempted-recon; sid:200054189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200054215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200054257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200054347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200054348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200054355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200054394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200054395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200054396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200054397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200054401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200054416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200054420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200054426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200054433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200054456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200054458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200054464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200054466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200054467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200054470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200054471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200054472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200054473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200054475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200054477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200054478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200054495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200054509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200054510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200054556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvavaes.visvccaneie.lkrmhnu.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200054639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvavaes.visvccaneie.mxjjct.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200054640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvavaes.visvccaneie.vhiucjn.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200054641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200054660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200054707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200054755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200054803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200054830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200054875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200054961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200055006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200055144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveiasecsn.viscaiescvsvei.yetbrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveiscesn.visacscevsvei.yetbrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200055283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200055420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200055557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vixlkpmkzq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vizvudayvg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vizxykkxxv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjbtngqizd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjbwxqdtzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjbysfrfew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjjmovppil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjkkvprdwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjlnwmbowc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjmawvwews.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjnted-pl-ijfoks.liweijie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjntetd-polska2dellvcr.polandsdostawahome70.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200055653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjntetd-polska8dellvrs.dostawkaplndsdell64.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200055654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjnxqtvzgd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjplgaxjkp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjpyldhliu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjqnmegkds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjrslnrkfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjtjaecsvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjztkimuym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkbhxmielo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkdhqulrwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkgolosmqw.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200055664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkhjswjkxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkimvouyka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkmatka.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200055667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkmoiagdzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkmsnmxiod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkpcqzwhrl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkrdetukgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vksuzvqvcj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkypwnplhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkyzzzlzli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vldualiwqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlecgqwhid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlfnkmeuxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlgvkwceyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlnbuyfcwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlneqdlkrw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlnted-polska.merchant6311465.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200055681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlopdkbswq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlpkezwihr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlsa-co.metacosmos.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200055684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vltseuzqbr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlvffrdugz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlxsf.ectory.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlzkqhtsfm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmboxx.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200055689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmcmytihuh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmctjgxnak.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmdjbdpypq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmfgjtlsuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmglpppeow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmgqgvimdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmhbzlsnqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmjfufhujs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmldnchkri.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmocfablug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmpelwrzet.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmpostkigl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmpqhxznuv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmqlestdxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmrubxguze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmsypeplko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmtfjoxqpt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnbzjlujgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnchbkywdd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnfegqwbrh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnfovcwjqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnhwyjjhjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnnxdzfngh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnqhzhlukd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnrrmdmwjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vntijpulid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"voceabacaului.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200055716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vocgfroovn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vocsfrpe.t.justns.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200055718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vofgqminou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vofurmcsbd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vofzskaraf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vogelvetgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vohxuzokoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"voicemail-refbe4d.sharedfiles-auth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200055724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"voicemessagejsgd.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"voicemessagejsgd.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200055726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"voicoddslj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"voies-ascendantes.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200055728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"volvocarskc.us1.list-manage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vondimpeux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vonkstrcke.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vopdrigxe.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vopfswajez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vopro.podia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"voqcaqicra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vorfojihog.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vosapmzcnn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vottwhebmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vouchere-astrazeneca.totemsoftware.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200055739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpaixxfdts.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpblprugdn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpdmdokgpc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpgwslvyue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpjhkplrlq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vppixnrlhx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vps47975.inmotionhosting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vps50749.inmotionhosting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpsddowcmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vptgdazdzr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vputeqqzka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpvwfrnlwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpwvbpmikk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpxfvbgeyn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vqkydyvozn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vqqiwblkwj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vqqycmqrii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vr5zqx.germanpersonnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vr786t76uty.yfcgvcxhgb45.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200055758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrenmfzzlx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vresksyeyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrhzugmcbu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrkimmcnug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrlfpolliq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrokipdecj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrowdcjuyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrpdlnumaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrqgcbcuvg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrtbkmknxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vruvjffozf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrxpbieuqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vryanfskby.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vs.ybgs66qc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200055772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaaiaaececori.vsavcarveoia.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaaisaecscori.vsavcarveria.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaaisaecscori.vsavcarveria.acucbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaaosaeaeceri.vsaccarveooira.ysjqhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacaaeeeicecevi.viaaescaarsvcrorai.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacaaeeeicecori.vsaaevcaarsvcroiai.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacaiseaeccscori.vsavcarsverriai.y2jph.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacaseeeicecevi.viaccaearsavcrcorrai.wtrapv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacaseeeicecevi.viaccaearsavcrcorrai.zxj6008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200055781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacaseeeicsceri.vsaccaearsavercrirai.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacaseeeicscevi.viacvaearsavcrcsrrai.gzj8007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200055783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacaseeeicscori.vsaaevcaarsvcrriai.mavbpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaccaaaei.visaecevvasaosr.ivupqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaccaaesi.viasaeevaassr.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaccaaesi.viasaeevaassr.iwqdzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaccaaesi.viasaeevaassr.vergeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaccaasi.visaeecevvassr.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200055789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaccaasi.visaeecevvassr.hzwrnd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaccaasi.visaeecevvassr.txvcqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaccaeaei.visacaasaosr.2124458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200055792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaccaeaei.visacaasaosr.nsqbty.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaccaeaei.visacaasaosr.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaccaesi.visaevaassr.2355587.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200055795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaccaesi.visaevaassr.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200055796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaccaesi.visaevaassr.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200055797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaccaesi.visaevaassr.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacceaaei.visaccasaos.gwoosi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200055799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacceasi.visaevsaos.bwzojf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacceasi.visaevsaos.vbojinw.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200055801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacieaeceacecevi.viascarsvcrorai.ehngpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacieveceacscevi.viasvarsvcrsrai.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacieveceacscevi.viasvarsvcrsrai.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacioseceacecevi.viaccarsvcroorrai.afevzf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacioseceacscevi.viacvarsvcrosrrai.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacvaaaei.visaecevvasaosr.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200055807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacvaaaei.visaecevvasaosr.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacvaaaei.visaecevvasaosr.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacvaasi.visavecevvassr.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200055810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacvaasi.visavecevvassr.dlsefg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacvaasi.visavecevvassr.hzwrnd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacvaasi.visavecevvassr.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacvaeaei.visacaasaosr.bcjgin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacvaeaei.visacaasaosr.ivupqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacvaesi.visavvaassr.2124458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200055816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacvaesi.visavvaassr.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200055817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacvaesi.visavvaassr.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200055818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacvaesi.visavvaassr.dlsefg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacveoaei.visaccasaos.mliqfef.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200055820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacveoaei.visaccasaos.vzsyjg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacveosi.visavvsaos.egqgvt.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200055822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiaaceori.vsvcaveoi.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieaceaecevi.viascarvcora.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieaceaecevi.viascarvcora.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieeacsaeervi.visacacvcorr.swlmui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievceascevi.viasvarvcsra.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiosceaecevi.viaccarvcoorra.oycpxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiosceascevi.viacvarvcosrra.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaisacsori.vsvcaveri.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaisacsori.vsvcaveri.do2t1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaosaaseri.vsccaveorir.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaosaaseri.vsccaveorir.eftros.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsbwivyswx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vscaiaeaaceori.vsavcavaeoia.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vscaiaeaaceori.vsavcavaeoia.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vscaiseaacsori.vsavcavaeria.dhwynj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vscaiseaacsori.vsavcavaeria.kxmmvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vscaoseaaaeeri.vsaccavaeooair.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vscaoseaaaeeri.vsaccavaeooair.bauwmq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vscaoseaaaeeri.vsaccavaeooair.exepco.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vscaoseaaaseri.vsaccavaeorair.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccaaeeaicaeevi.viaaescaavsacrorai.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccaaeeaicaeevi.viaaescaavsacrorai.acucbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccaaeeaicaeevi.viaaescaavsacrorai.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccaaeeaicaeevi.viaaescaavsacrorai.fbseba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccaaeeaicaeevi.viaaescaavsacrorai.lsikdoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccaaeeaicaeevi.viaaescaavsacrorai.sfoofl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccaaeeaicceori.vsaaevcaavsacroiai.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccaaeeaicceori.vsaaevcaavsacroiai.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200055850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccaaeeaicceori.vsaaevcaavsacroiai.fqbpis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccaoseeaacaseri.vsaccavsaerorairi.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccaoseeaacaseri.vsaccavsaerorairi.vaylqb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccaseeaicaeeri.vsaccaeavsaaercoairi.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccaseeaicaseri.vsaccaeavsaaercrairi.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccaveeaicasevi.viaaesvaavsacrsrai.jlsnos.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccieaeeaccaeevi.viascavsacrorai.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccieaeeaccaeevi.viascavsacrorai.gjqyzk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccieveeaccasevi.viasvavsacrsrai.rjohat.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200055859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccioseeaccaeevi.viaccavsacrooarri.kokfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccioseeaccaeevi.viaccavsacrooarri.ysjqhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccioseeaccasevi.viacvavsacrosarri.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vscd.zgwbds.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200055863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vscieaeacaeevi.viascavacora.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vscioseacasevi.viacvavacosarr.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vscioseacasevi.viacvavacosarr.moogyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vscioseacasevi.viacvavacosarr.zxj6001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200055867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsd.ijprqkx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200055868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsdbf.nlabnfa.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200055869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsdf.xkwmyz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200055870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsfbgcjmaw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsfrviqvcj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsfvccapfl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsfxuwkedf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsheudpycl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsieacaeevi.viscavcor.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsieacaeevi.viscavcor.o3ufga.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsieacaeevi.viscavcor.rgiclw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsievcasevi.visvavcsr.3pax4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsievcasevi.visvavcsr.verse7.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200055880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsioscaeevi.viccavcoorr.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsioscaeevi.viccavcoorr.ayqtuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsioscaeevi.viccavcoorr.ssfszj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vspavzreos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vssaiaeacerori.vsvacaveeoisc.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200055885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vssaiaeacerori.vsvacaveeoisc.bqoqzf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vssieaecaerevi.visacavecorsc.cdxkvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vssvcdicwd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vstnybwdji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.cckrka.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200055893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.owbxts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.cckrka.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200055961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.urgggv.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200055985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.obekup.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200056071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.yxpfzh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.yxpfzh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.jcqpfm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.urgggv.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200056220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.obekup.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200056240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200056293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200056346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200056482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200056619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200056756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200056893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200056999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200057030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200057167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200057304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200057441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200057578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.xuacoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200057694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.yxpfzh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.obekup.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200057712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200057732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200057785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200057922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200057999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.peshlh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200058021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.obekup.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200058054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.owbxts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.urgggv.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200058069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.yxpfzh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200058130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200058267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200058404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200058541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200058625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vswcoiqmab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsxqrsldzq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsz.dpbdquk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200058628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtcwpoatzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtgmzrfeha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtgwjvpmxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtkmzkdpjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtkusxvqnr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtmphlafhu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtual-psnascursl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtxmail2018.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200058636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtxseootnr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtzgxwfddx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vub-appsk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200058639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vubqevfviz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vubyxqqqhf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vubzbilmoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vuecpzctoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vugtmayqmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vuhqphsqsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vuhypnryay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vulkuzsbba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vunjmgrkxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vuphgavuwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vusrcapenf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vutcpinsdd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvajzphhjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvallet-palyogn.technology"; content:"Host"; http_header; classtype:attempted-recon; sid:200058653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvanm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvbjrlnlzu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvewmpabkf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvfcsarnou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvhpugdpet.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvjeshmlgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvjyqwwkgv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvntechnologies.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvqhhqqpgv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvqkogllhu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvstkjfakr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvtkunnutj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvueqqwlbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvv.lnterbamklbenefit-pe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvvlwxlxoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvygdjfxla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvzhgqqvfx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwesqmcfra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwftfbhmqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwjwwwjjjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwlkrtcnpz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwlsqhkjsf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwnbpgcwyt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwndsvlxlu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwopngsynr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwoqhivhak.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwoubewdks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwouozkqio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwsaessrin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwsdwzdbxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwswfmrhud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vww.lnterbamklbenefit-pe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwxjkufvqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwzroxbgfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vx.c9in4n7.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200058688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vx.oyiorpg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200058689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vx.wcw3oln.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200058690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxacocrhdj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxaexeulqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxaixn.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200058693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxcd.yatpvbn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200058694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxd.fznobe1r.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200058695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxd.igwkrxp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200058696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxd.udodcvk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200058697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxdse.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200058698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxeilraiqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxhkivfrkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxkixlwvut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxmkdqtucy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxoaxyhtul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxtcmgfpli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxtyjhaias.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxzrmtixhd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxzs.hjmhlnl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200058707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxzs.vcyqzek.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200058708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vyattaworld.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vyfuinlsve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vygnxgflnw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vykuntapuramtenali.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vylxxqnfmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vysqcygavl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vystar.toorassociate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vyvmrcbecj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vywyffrzzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vyxokmgxca.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vyymhbyipg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vyzyomekia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzds.u1m33p9.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200058721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzhbynyzjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vziaipjqjk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzmrxkgmlg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzqxzvsiui.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzrnlwnrwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzsgryjfkerzshbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzujkqooap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzwpjpxcvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzxredtgyiqw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzxsrkqgpt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"w.digitalfans.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"w103994-2884.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"w103994-2884.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200058734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"w6eu6w77.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200058735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"w782409br247e.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"w83774-3843.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"w83774-3843.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200058738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"w9eventos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wa.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200058740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wafygvpsdn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wagjbzpgan.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wahana.lk"; content:"Host"; http_header; classtype:attempted-recon; sid:200058743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wahed-koudsi2001.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200058744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wakhrzxkcn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"waldenkathy59.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallapop-paying.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200058747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walldesign.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200058748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet-connect.serveuser.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet-connect012.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200058750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet-exodus.siterubix.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet-exodux.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200058752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet.nnynnonero.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet.polygon-technology.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200058754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet.polyqontechnoloqy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200058755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet.silesiacoin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletappsolution.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletconnects.tel"; content:"Host"; http_header; classtype:attempted-recon; sid:200058758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletconnectw.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletreconcile.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallets-solana.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200058761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallets-support.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallets-update.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200058763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletsdefi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallett-orgnear.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletvalidation.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200058766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletvalidators.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletwebrectification.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200058768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wana78420.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200058769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wandering-fire-1c00.jamaljewellerry356.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200058770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wandering-frosreg.people-meedia.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200058771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wandering-recip.u1r79b1c.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200058772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"waoygpyygu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wapking.com.se"; content:"Host"; http_header; classtype:attempted-recon; sid:200058774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wapuzagrfq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"waqassupplies.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"waqhiualwv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"waqoyblbfm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wargo.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200058779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"warnertelecomm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"warsa.bandungkab.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200058781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"waseswayya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"washingtonconstructionconcepts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wasserdynamic.com.my"; content:"Host"; http_header; classtype:attempted-recon; sid:200058784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"watch-unlimited.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"watchess.com.pk"; content:"Host"; http_header; classtype:attempted-recon; sid:200058786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"watjclhoua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"watxrjcmte.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"waves-enterprise.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wavivzqswf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"waxhmlxtgs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wayuai.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbcfvkzmmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbgdnepshi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbiruapswt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbjzduvnxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wblewtyspt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbma2022.eu3.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200058798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbnbchismj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbryucmhef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbthrxkdyn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbvfvzqgmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbvjmwsuxz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbwksqxpno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wceazwtpqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wceitvhdnv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcjekrstkj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wclcrumpjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcnbjtwiam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcnclvscyi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcnxgcozoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcnzazjesv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcnzgiefip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcrjvxtmyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcsixwyctn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcxomeiofc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcyfmyrgkt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdadefxzdcecxxfr.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdbfupzroi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdbjirrdpd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdcmstfarr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdcsrqzshb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wddjanpwsc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdfclkhohg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdfdzfjhsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdhlcidris.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdkipomgjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdnpwxfnad.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdsjyookfr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdwadazuvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdweebwuuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdxkbydzzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"we223scalefolde3uidirish1689399774tabs-relevantmajd84.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"weathered-bread02.peoople-media.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200058834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"weathered.mnevicionzone.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200058835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-accesso-id-clienti.itsaol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-agricole-info.preview-domain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib.mizuhabangk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-mizuhobank-co-jp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-sand-home.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-soc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-soc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200058842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-viabcp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.activationaccess.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.bank-mizhuho-jp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.miizuhabonk-japan.uctionmae.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizhuhoobankes-dowo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhebank-co-jp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhebank.co-japans.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhebank.co-japans.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200058850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhebank.co-japans.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200058851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhebank.co-japanss.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200058852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhobank.jp-socool.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhobankz.confirm-update-jp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.iib.mizuhobanka-jp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.logodesign.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200058856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.prodepo.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200058857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.serv01.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200058858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web1.ib.mizuho.banke-go-jp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web1.your1shopwithxz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web3coi.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200058861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web3helpers.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200058862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web3rpc.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200058863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web3rpcdev.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web8493.web07.bero-webspace.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200058865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web8610.web07.bero-webspace.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200058866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web8634.web07.bero-webspace.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200058867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webairbnb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webclient.moreapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webconnectappsync.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webdatamltrainingdiag842.blob.core.windows.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200058871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webelektron.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200058872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webemail-syksang.sang42555.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200058873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webm-c3af3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webm-c3af3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200058875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-109295.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-cisco.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-cisco.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200058878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-iinet-net-auindexphpmail.builderallwppro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-laposte19.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-laposte27.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-roundcubeblack.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-roundcubeblack.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200058883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-sso8uyg.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200058884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail.bellahills.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail.salemgroups.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmailadmin0.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200058887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmailmaster.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200058888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmailpt.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmails-verificationdata.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmails-verificationdata.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200058891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmial.constituters.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200058892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webpage.revenue.services.i9tn4.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200058893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"websecupasslibrpstbpqs-authcertiplus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webseguridadportalbancadavivienda.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webservice-mailupdatemail.arqanexportcompany1664.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200058896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webvalidator-interface.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200058897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webwalletconnect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webwordss.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webzonasengurapinchincha.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wedadobe0001.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wedadobe0001.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200058902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wedadobe0002.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wedadobe0003.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wedadobe0004.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wedadobe0004.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200058906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wedadobe0005.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wedadobe0006.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wedadobe0006.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200058909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wedadobe0008.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wedadobe0008.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200058911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wedadobe0009.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wedadobe0009.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200058913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wedpahecey.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wefpvsnidm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wegotgoals.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wejkqndrzh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wejotwmqye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"well-account.introductionally.webhostingforstudents.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"welladdon.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wellhealthhtc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wells-1-b9573a.ingress-baronn.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200058922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wells-private6-bad7df.ingress-daribow.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200058923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wellsecure1.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wellsfargo.xghklkhggl.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200058925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wellsfargoverification.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wellsfargoverification.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200058927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wellssecure91.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wellssecurelogin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wenandwander.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wenmail.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"weoiyvcj34jk5g.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200058932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"weplays-connect.tv"; content:"Host"; http_header; classtype:attempted-recon; sid:200058933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"werare.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200058934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wervicerh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"westrock-corp.dongfangfuli.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"westrockcompany.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"westrockozarksjobs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wesxkwebam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wesyrtqhpk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wetalk247channels.tv"; content:"Host"; http_header; classtype:attempted-recon; sid:200058941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wetransfe-f5044.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wetransfe-f5044.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200058943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wetransfer-92b7d.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200058944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wevpjrduhz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wewillpmhb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wexalrvero.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfauhicjuz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wffewpahzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wffvfizxba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfljfgfsuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wflmnqproe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfluhvxroj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfmevfxqkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfmfgjxhvq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfngqpqfxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfomtdempd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfpookfufm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfqbimuhme.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wftjchgerv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfzpcnnerb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfzzrmlcbj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgdnqshuas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgfcswasio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgftpxqxoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wggfdrhkga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wghzgpldcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wglpidrnbi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgohkdgzou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgpobhpmil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgrcfhphyh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgrgsykhpm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgufiywnay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgujarxzfn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgyaghzmkw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgytzmjglr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgyzbjeenn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whabfepshd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whare.100webspace.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200058979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whatsapp-amel.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200058980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whatsapp-gruop18.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200058981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whatsapp-update.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whatsappgrp.clct.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200058983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whaxidtkmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whdmbassig.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whgsmmewsh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whisperedglassapplicationframework.tasterompile.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200058987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"white-bonus-05b3.wastemanddd.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200058988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"white-field-05e4.kdg6smak.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200058989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"white-glitter-ba48.casterweed.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200058990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whitpmacda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whkmkwwkqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whkxlqjwpa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wholecalmhypothesis.pablseg.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200058994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whrhnpbeqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whuythyeup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whwdnucykb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wibrzaxgzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200058998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wicannabisco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200058999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"widadkamillah.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200059000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"widget-dot-lbk-asistente-pre-principal.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"widlba.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200059002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wifldevehf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wiiegsyndc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wikkwitlwj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wikqivbknw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wildcard.infomav.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200059007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wilezpecqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"willowfranklin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wim7pt.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200059010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"win-31082022.s3.ir-thr-at1.arvanstorage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"windstream-net.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"winesonjanesonpublic.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"winesonjanesonpublic.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200059014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"winted-purchase.809142.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200059015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"winter-thunder-a1ba.gdjklahdkjsadampie.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200059016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wioyfmpaqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wiqvwolpcs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wiqwchdnyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wireconfirmation68c10a25442a3e13.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wires-business-starter.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200059021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wiselogin.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200059022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisgjgjhtios.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisgjgjhtios.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200059024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wispy-flower-c715.westemoreland.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200059025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wispy-frog-f21d.kbc21bma.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200059026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisrjpeqvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wiwmgozsdg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wiwxfcstge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wiwztyynon.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wizardly-shockley-f824fb.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200059031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wizcukdcur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wizqxcicoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjcrtxtfdc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjdvydkfkn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjfbbcmntn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjfuqpiffd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjjgubcmrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjmmzzzlyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjnyognctp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjplhjlrho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjqujqwjac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjwwjwvamm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjymyoidel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjzannzlqd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkayjsibdg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkazisan.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200059047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkbinqhkbu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkeumpmzbu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkfjmjorpr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkiirahykn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkjnzskjnseka-lbx91xybtf747394.codeanyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkljpeuliy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkmhziyisx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wknqpzrvxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wknrdkfnwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkokkwddyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkzrznsvhz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlabaszqyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlbhdemdxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlfrjbfazx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlhglmftvt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wljvejuvma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlkfjahqav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlkljewkrw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlnimokfrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlnwztyami.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlocxztucp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlqjthrjvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlrbfmuczd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlrlcwqbvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wltcnt08201.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wltkqlekpi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlukenrace.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlwjopfeur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmajcemnig.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmasxoihgs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmcekcwuwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmdeszmafz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmeyeagdss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmhqnluawd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmietjzklm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmjinhjldj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmmqvddjfx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmpkddjvuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmqfctjjex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmrhzoyhxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmskuzefyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmtkqgrzqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmugsjbrxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmuqmsxbxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmwkswpktk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmyciueyda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmykdxtfjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnalkwqbgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnbpjveave.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnetxysdme.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnfottswsi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnghkauunz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnijxaqzhj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnlxnxcnlv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnokjkrmmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnqowbzlrt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnsrt-com.preview-domain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wntcpppoul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wntdtplgzg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnxjwgaapq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnyrpzqqho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnytr.fellage.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200059109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"woabfctiem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wobbla.se"; content:"Host"; http_header; classtype:attempted-recon; sid:200059111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"woefulsnappycpu.productalls.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200059112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wohnqlwgrr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wokgdpzirv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wolfhousepros.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"womqyxt.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200059116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wonijumypd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wood-languid-geography.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200059118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"woodmetalstil.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"woowclzccn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wordpress-837310-2884326.cloudwaysapps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"worgor-sh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"workhomeblog.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"workprotocoles-com.webs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"workshalas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"world-js.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"worldbaonlinedc.ddns.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200059127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wotowfmcxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"woucfsvsgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wovfxmxxct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wowfpiqpip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"woykhinvoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"woyymnsful.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wp-login.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200059134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wp1sl706.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200059135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpcinadsxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wperfthuvm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wphapxflkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpiawilyoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpkcizzdrw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpmknsecqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpnrotoepv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpprhidbdt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpreviewchampion.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpsoar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wptest.chopperward.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wptpsmdjvq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wptwizeaqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpvkzgpxny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpwubutshs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpxotmywns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpyklztyeq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqdwwuqzdc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqivodlrlv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqkfjzrwta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqlpepxegj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqojusviwt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqorclzrpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqprtmsnoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqpvpsykqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqssuizqni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqwowpsyab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqwyxrhjjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqzarlmrdg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqzqwogffo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqzuijzdkj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wrbmypvgjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wrevcvcxhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wrevqjvpjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wrfybiefxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wriiaidpyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wrkcchdiwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wrlaxecgcu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wrlmwdrywe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wrqkevobqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wryprtyrvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsarlpoiim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsdqwfplut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsi.no"; content:"Host"; http_header; classtype:attempted-recon; sid:200059179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsjpqtshnj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wskcxhhmue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wskhsbylfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wslnppvgqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wslyaotmcz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsnmatyuka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsqlsgmttx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsrjdjvgtn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsrlqyotvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsumittoiz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsuqvrgzyn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsvphaysez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsvtgvygcd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsxrmcku-115297.proposhareportalauth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200059193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsyiilpady.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtawwyvgef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtbyrzaeyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtcgdhwtmg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtdiimbvnn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtlnmgvapx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtlzywwrcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtnufmzhvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtpgbjjbxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtpreenjve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtqwfgpgvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtsaroyssd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtxacbfbkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wua.soundestlink.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wubrslhbqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wuehhciwds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wueuxgqzpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wuewzxiksy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wufuqb.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200059212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wuimwfhyjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wuinso.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200059214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wukfbgvkme.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wulddwacua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wulximaqjn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wundxiqezz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wuplcagzio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wuqgpcqxdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wutkkjjxwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wuyeuaaigl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wv3vajpaeass.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvbmmzipwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvbskkyovq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvevarxccn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvhhihvzer.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvrcdwklqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvv.lmterbarkbenefit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvvjsnmtko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvvv-aol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvvvpinchincha.tfs-peru-escuela-de-danza.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200059232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvvw-uniswap.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200059233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvvw.bancaporinternet.extracash-lbkperu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvw.lnterbankbenefit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvwmpufgce.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvwoappcpp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvwsorare-com.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvyaxvfljc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvywwjcyee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvzkbkdwxz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvzonasenguranpichincha.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ww1.ibkcredit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ww11.lbk-personas.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200059244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwcdwithtesla.xs1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200059245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwdghzwfgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwetldjejt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwjdqcvatm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwjwkfprmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwkkderxee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwpamfpsal.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwphhwxkgi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwrccqxglu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwsttuusrq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwv.bnnco-falabella.cl.ugottpest.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwvzonasengurapichincha.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200059256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwvzonasengurapichincha.store"; content:"Host"; http_header; classtype:attempted-recon; sid:200059257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-bitflyer-go-com-br.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-cita-previa-en-linea-cr.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-cursosdigitalesmx-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-degelyehuda-org-il.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-dkb-de-login.amuchamltd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-dkb.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200059263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-dofus-touch.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-europe564598-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-europessign-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-ing-de.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200059267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-magic-eden-welcome-0y.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-mkbnet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-pancake-swap.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.aoerseraz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.aoersercz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.aoerserez.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.aoersesrz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.aoerseswz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.aoersesxz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.aoerseszz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.esapescend.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.esapescued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.esapescund.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.esapesraed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.euapescasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.euapesczed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.smbs-cozec.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.smbs-cozw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.smbsacnd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.smbscrad.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aceizn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.acenon.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.acsnon.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.amazaon.co.jp.login.baihumi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.amazaon.co.jp.login.diangewang.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.amazaon.co.jp.login.lianxinyu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.amazaon.co.jp.login.lorgl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aoecsaz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aoecsnz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aoerseraz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aoerserez.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aoersersz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aoersesrz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aoerseswz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aoersesxz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aoerseszz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aoerunrez.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aozcset.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.arnazon.co.jp.login.bailingshop.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.eakl-nucra.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.eakl-nuzra.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.eakl-urens.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.esapescaed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.esapescund.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.esapesraed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.etc-meisai.jp.iwander.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.etc-meisai.jp.nongsuyun.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.etc-meisai.jp.rxoqpf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.etc-meisai.jp.siqlcg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.euapercesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.euapercnzd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.llifeccard.co.jp.sazcac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200059319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.micavtcd.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200059320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.smbs-cozec.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.smbs-cozev.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.smbs-cozw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.smbsacnd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.smbscrad.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www3.idpass-net.nenkin.go.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200059326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www3.vpasss.ne.jp.zscgsz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200059327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www4.daviviendasas.mobi"; content:"Host"; http_header; classtype:attempted-recon; sid:200059328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www6.amazaon.co.jp.login.u0h2pl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwwhomedecoration.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eukl-peaecoey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eukl-peascoey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eukl-psacueey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eukl-puauaesy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eukl-pzeuaesy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eukl-rcetey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eukl-roeaaesy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eukl-roeavemw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eukl-roeavezw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eukl-rtscsy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eukl-rzesansy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eukl-rzeuaesy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eukl-ssetey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eukl-toeaveaz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eukl-toeavsuz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eukl-toescsuz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eukl-tsecsz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eukl-tuuscsuz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwwwv-roblox.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwx.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200059350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwxgnjzvbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwxvhanick.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wx-magic-eden-september-qw8.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wx33s1.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200059354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxcmmmsdtr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxdkbpzmrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxdsfaeawm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxdvbxnhpq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxfivsrjzh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxfmhy.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200059360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxfyxqlfys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxgliejofv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxiwmowpzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxjoamnaoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxobzlqzvr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxsnufmrks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxt.b24.mywebsitetransfer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wybnwyteco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wydrgryqyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wygtpnrzds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wyiataxfmg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wyjbdgctrj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wyltokqcig.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wymjvaxhcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wyokvefwdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wyolvuxntj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wypuoyuptt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wyrtcfcvze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wyshhkkiod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wyvhwqlqtn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wywpopdhzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wyzyesmtzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzatcuewsp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzbhdelmxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzclypzsnu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzf4cx.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200059386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzfgjqkmdt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzglatqaky.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzilsvvuvt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzjcwgkxxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzkeojirlw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzlilxpdlb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzoctiftgv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzssvqdsqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wztecnfavw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzwciplosr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzwtkiairx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzznzeeybs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"x45v3v7c4564.activiodavive.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200059399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xagfvisppx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xaima728191.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xaimsuuq211.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xajkazbmav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xanderh.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200059404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xandero.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200059405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xaoaiqgqqd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xapezbfayo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xaryqgxbmo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xavyqwhdcb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xawkdtcavp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xazeitqxaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xaznwbkdlh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xazxqwhlhm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbfnf.65918.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbgevhriut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbglqfwlbw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbgrfwzajm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbgvfmorjb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbgyxmagbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbhjjjblpg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbhoyxzhwc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbigdxyyke.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbmgtduvez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbmnnpsmbn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbmrsycajm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbngrzgbwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbnkvgyjrm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbpdndgioy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbprpbsoit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbptoouqqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbtcbtbygt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbupvqjdcj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbwgbmkrdk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcaizjckcz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcbaljwiae.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcbbanmyll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcbrhysdfagh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200059437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcd.weixin62.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcd.wuxhbz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcekdqqsiw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xchrdlvlwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xchvtfakfb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xchwqtktsi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcikcszwag.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcithcxqxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcjmnapyku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcjrhvuazp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xckufylmqd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xclpppjfhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcoonfflsc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcopy-freemint.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200059451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcpesiokbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcptoiokzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcridsjalf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcrzstudes.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xctmrvnxqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcxnbfjteh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcyhrivqjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xd.dlhc6uk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdbbpoiyll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdbzotxkus.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdekwkethx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdfccfbhhe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdgmoqwjlt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdgr.wq27an.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdgsvpjhju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdhgogwixt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdlmqwleia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdmjwaqrif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdoqsaldtx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdrqpwpwsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdrsdqpmlq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdtkstftue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdv.axpwsbt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdv.ozvxwyb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdwhoxozsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdwrnskoaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdxuqlbcql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdztexufyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xeajqawjak.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xebfuaffpe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xecbufpebk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xechwxjhdm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xedhfaeefh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xegdabhznm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xeghtcavxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xehgblgliw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xeihzwvxxv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xelyroyerv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xenmkaxsmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xep.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200059491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xepnakkemp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xerclinexz.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xetpkgetmi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xewcasagat.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xexynjdeoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xezslgasiu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfamlmeizu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfeoxxokua9.typeform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfinniityinox.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfjxoixwwv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfndbuuqbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfnjmxwwvv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfplhrqyfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfplyibfvf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfslhqvyst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xftkuiicdo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfwkzuefby.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfxymqbmmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfyuaqloke.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfzozcnlod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xgesvhfaun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xgfnvkzwpk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xggllpnvqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xghjm.0nh61zh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xghlsp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xgjfiamvsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xgjwsrwbpx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xgmnocoudb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xgvbigmdgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xgvyzgorje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xgyvyvzcmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xgywicljvr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xgzxpckvjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhbxslqqfz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhejotyhzo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhgsysglvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhkxwijqfz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhlaivvkot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhlxxtaoln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhmjpngeqw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhnjv.fzjyzqa.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhrloywhgy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhvrfungim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhxvwlbvly.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhyrhmdzgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xiczmesjxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xiczrudijy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xifpauwscu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xikdjtifsr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xiluckqbmw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xioksurnsh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xiqgvtzwst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xiqhawzsli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xitolglalx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xiwteilmtz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjcwcsjxar.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjfdgdfhgdhu.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200059548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjgchwqwhh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjhvuhpapp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjivwaazzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjjhfbhbxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjkrwtyvsw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjmhmqgiin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjnyyknpwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjoszjnnzr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjoyjthpff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjpbsxxblj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjpepzhhnr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjprbpjyyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjupcejkwz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjvwnfowjk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkdudiognk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkftpzjfib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkgrftljou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkicwycssq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkigwhmsap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkolqhrnsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkplexjtwc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkqktgbtvt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkqqhatugs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkrdytxief.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xksykwstag.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkuzllldbv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkwjppduim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkyadrymad.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkzfnbxsyn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkzmjhrmus.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xldufqnxxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xlhlpanhba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xljirhdtjv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xllzqvnsij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xlqexxohjj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xlrbgssdct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xlsv.oalt.cfgliders.com."; content:"Host"; http_header; classtype:attempted-recon; sid:200059585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xlviftncap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xlvosjykqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xlvsrkbrnm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmfubifyju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmgqanuqfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmilupzwtg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmjppvrcdh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmplimnbsi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmqcmtxyab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmqieeyqup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmrhtroukg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmsalzzhln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmsdlgqbfi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmsite-coin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmtntydhtx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmwztknahq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmxbfqphrq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmxrtrftem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmyzchdryp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--allgrolokalnie-x4b.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200059605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--conta-atualiza-o-snb5e.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--ltappen-80a.se"; content:"Host"; http_header; classtype:attempted-recon; sid:200059607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--ooksrare-mnb.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200059608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--phere-udb.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200059609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--pksvvp-itaae8dya20i.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--pne-cla6byc44c.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--seguridad-en-lnea-qvb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--w1ai.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200059613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn34r.app.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200059614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xnbepeusft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xnbkhowlbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xncofpdpnh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xncquvescq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xnfjcufiic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xnjmnjunpa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xnkuqtoesv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xnpqqxmfzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xnpsogyquq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xntjyiicds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xnxxn7w8asd.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xnyjotbtgj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xoflrqitml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xohdaofoki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xoikrkexwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xombipkpyt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xombyoruaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xomyohiswl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xonuluzpye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xovdejjvaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xovebvrzsf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xovloktepr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xowomjrtcg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xoyzixmipy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xozbrlkjjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xozkhyghyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xpenovycaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xpgdqbgvxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xpghnmhesq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xpgomujnui.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xphmtqlihc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xpjmmrinje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xpjyyohjee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xpuebbthwl.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200059648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xpwmkkuxnb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqcpeou.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200059650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqftmpalzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqjgmgnjkd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqlgwhqfrm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqmfftkhwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqnpwoonlm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqojvfkzvf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqppikjkkd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqstsmiajv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xquhmerroi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqxdbhyjth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqzkbzbxlq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xref.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200059662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrefhhsriv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrelddvmcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrfmylkvbc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrhdysyjvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrihsdvlpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrmdmuxnnx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xroqjhevgr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrrwgmqfxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrsjyctosj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xruwwgaizx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrxycmhzkc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrzjlncqia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xs.gkxfauo.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsabiizfzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsaqqqelcr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsbndzrrjs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsbrookshhjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200059679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xseitubmoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsfnkiblzs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsixghxkki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xskzpykzan.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xslwiyjzsw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsmrzstasz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsoxukhpmj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsportak1xsxrs.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200059687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xswypkhvri.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsxmslsxnm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsxytkjgxe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsylproyen.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xszrqhlzdz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtbkfeykyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtckqewqgv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtgxahpctc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xthycgkvlm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtjxrjlicr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtkszfyqwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtremeelectricinc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtrkdaxzdx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xttquynyqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtypizksiu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtyyehgxac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xudyabnmnj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xuhdcouqxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xuhuotsdbi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xuilwnxngw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xukgzylria.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xuojwbahjk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xupsjadetf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xupwbtmfna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xurirgzrgr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xusafiwxhq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xusbmamvjn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xutdbqekwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xutqbbcomt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xuxiyjbila.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xuxlanhhof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xv.hmemwyd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvalhalla.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200059720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvbmndazca.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvd.mf7t0ah.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvedglkbgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvfkzlnqxo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvgnkpleaj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvhccclzps.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvjhycauzw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvmjighcda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvmtqncdzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvpcmiqhqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvpukwefph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvqxfjmvez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvsppxyrgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvulrzjtse.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvunbwmqtr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvwayrsupa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvwodrrlyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvxkdfuwte.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvxnfzzuuq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvxvahgyka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvxwsjdhba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvynduwkjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvz.09vnsr7.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwafqjruei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwdgzxbpoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwfnlwzham.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwfsqnhvjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwgrgdrlnr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwjtguubta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwkjkqsjtd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwmtyoberm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwoikdixod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwqbgolaqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwsawvcybp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwufdrgtag.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwwvypfuix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwzfbiftij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwzndkpuos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xx.yknis.pellegrinaggiomariano.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200059759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxawofpbxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxcbbqadhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxcmkwfxco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxepevqmig.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxgaiusxap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxkl.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200059765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxmrvrnrxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxoirvycyk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxonkliadr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxphase.office0.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200059769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxrfoloqjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxtwtimqci.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxwuiqwjkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxx-com-dot-c2c01-531c7.uc.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxxxxxxxxxxxxxxxxxxxxxxx-eba51.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200059774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xyawtsliyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xybnqvtund.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xybybopsum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xycfhqnvry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xykdretnjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xymvsnygoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xypbryoulg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xyrugbmqyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xythndo.punctulcentral.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xyysktrwvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzdcdsxrbo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzlijffcqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzlzmvzoio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzmuahjnay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzndrqbsnb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzokefikgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzshkzkhfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzutdthpiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzvnespyxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzzdktajyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzziixxwoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"y24ke.34ei.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200059796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yaaxdgmyqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yadeargbht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yaehaoolgian.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yaehaoolgion.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-100047.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-102926.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-105946.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200059803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-107539-101448.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-107672.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200059805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-108394.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-jp.bifinity.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-jp.jymbji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-jp.paisoier.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-jp.sx88.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200059810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-jp.wifionoff.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo.mailservice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200059812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo442.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahooincserve.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200059814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahuomall.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200059815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yairix.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200059816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yandus.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200059817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yaqancnixu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yaqoobi.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yasufhgiuy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yayanti.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybblxvqtqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybcrovdhsk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybcujrxaxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybezkocfxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybfdvjmtj-01924995.middocmain.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200059826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybiaojhcqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybkphmoevz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybmonrozxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybpvccveqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybqxrkeozq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybszfdifte.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybxycbugwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybyxbmfsjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybzomtmpvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ycabukzlfb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ycfqtardfy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ycjigzyvrc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yclivrzpir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yclnflzevn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yclrluoipx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ycmoautosj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ycpepovkml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ycqvmzvoxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ycyzgkkeqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yczimudegt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ydktplowim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ydmgsfeisq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ydqyieyqbn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ydqzuxihdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ydtezmsliw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yegnqdvamk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yeiwscqije.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yeogmmlsqc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yesqyudysc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yeuqyryevb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yeuqyvhxwo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yexxvdsyay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yezmbsdqcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yfatura-luiza-site.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yfchkbiupx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yfevrpihgm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yfhccswkcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yfhikkeaih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yflvduftbx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yfmsgkmqzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yfqkeaicqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yftfmznujr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yftgmzuxvi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yfvaojycyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yfwufxhorp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yfzpkxmhrq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygacxnmsxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygbhn.upling.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200059874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygbmtdwfar.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygemsgzxfx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygevkixnfi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygjzwretzm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygkutqx4.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200059879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygkutqx6.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200059880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygmjvxzdwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygorseasqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygpbeteirh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygqkmwnhol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygqvajbgwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygtvcagvqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygumcjpwla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yguzezliya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygwaaefqag.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygwlmnlbxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhbcjlffll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhccvhslzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhcruvmzij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhdhqdeydi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhfdb.wta4ji.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200059895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhffheruud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhqccvacxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhqgwwrxib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhqjipteav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhshcnqxlt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhxczrjujz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhzllebhah.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhzrmtuyat.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yicjmdzjxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yiffrcncug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yijfdzhhfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yijnyphgpe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yikwgtbuke.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yimltisiqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yip.su"; content:"Host"; http_header; classtype:attempted-recon; sid:200059910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yipee.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200059911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yipugmsfdd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yiqvcfxyee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yitmtlbwvz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjerhyzpth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjfnohvoxb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjfpdlxnjs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjjyzokefm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjlxrbmbae.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjmmaxurnw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjppdlqtqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjqhsaffut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjqosuavdb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjrnrjidrc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjrxddzney.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjshqxbdrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjtiftfceb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjusqurxmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjvhpbxbbw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjviutgfsr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjxszdbngl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykbvlszcbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykbxruvsoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykcpjcxuxv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykdrseyufj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykfrfgatjb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykihcwrxjs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykjdpjccav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykjptmrrmn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykjscnqwsy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykkbkjpsnv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykllaopwcp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yknagkvdvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yknvettqlw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykpqlnddpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykqwjptarj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yksvkwstwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykxidhshrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykzfiwmhsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylaacccrgy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylcftxfpka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylfizlqssx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylinlalcrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yljbkgehgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yljvajxhze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylkxjkjvob.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylrxdgtoju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylshatzwql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yltpdhnbxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylvxveorly.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylwgrcqawj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylyidpcyrv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylyomwxczz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylzcwxicsz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yma1ll0g0n.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymaclzcgxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymaszyayqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymdaepaogx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymdaetsqqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymefzyrkgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymjhpsgwov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymjrohietp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymlvmoivrd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymmjdthfzw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymspzsgurs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymvbwhasvj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymvkqavbdy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynakwsmmzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynauvpslzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynbzjrzfii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yndwpujhhw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynfcmxybte.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yngchewchj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynhwblmhcz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynhyzatzgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yniykzassaz.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200059986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynjcxiehie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynmvcofzly.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynpzksxqqy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynqz7317.odns.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200059990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynsnnlsnva.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yntpdagkql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynwdcqeoxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynyjqiwtom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yochuksoza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yocmmwstkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yodsecinserv.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yofniaeixl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200059998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yogdarshan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200059999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yogicpa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yogini-polygonbc.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yogjhtcabh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yojylbizyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yonfxspbnv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yontxaprdw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"youn.bxxnskkdkdkrkrnfnf.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200060006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"younhvaomj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yousee-refusion.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200060008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"youtube-b24.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200060009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yowacrcesl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yowqzxmeux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yowtehoeeh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ypdbifcalx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ypfbjdvbsq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yplbxuqaov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ypmcsgtlir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ypohyextap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ypokfnpdtx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ypugmopnqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ypuppcjmyt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ypvhpbcwmv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ypxwwdleyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yqbkqrmmuy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yqcmbcfvix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yqdnrjhjfr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yqfglywvus.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yqkykbcpjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yqpikxcyay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yqponqxknu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yqprjxfvzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yqrluoyxto.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yqtkrjyxej.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yrdsgzcisc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yreftry.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200060034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yreoafevpk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yrgxcbbtut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yrmnvhgyhq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yrnbceydsn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yrqxhabwgm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yrscawxhhf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yrsfrmukjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yrzfsomwrx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysaftzsdmi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysczdajs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysecilxheh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysfaqdxkip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysgjjnzuna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yshlpcwcjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysjbrdlsjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysjuhlxebf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysmijwcdul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysmknsevuy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysrdgifrai.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysrnudmtkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysvhnvguqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysvlhqathm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysxneqxhiz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysxxdcrzhf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yt8734569849.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytatyrxvqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytbenbzbuv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytdefdpocn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytek.co.il"; content:"Host"; http_header; classtype:attempted-recon; sid:200060063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytfkwitzdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ythbregvergerg.jutnhybgtrefsc.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200060065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ythmehgfdu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytilrnsibb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytitizgvgt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytjhrdzqji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytjyhegf.byethost32.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytklhg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytlrvatpwo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytmebaecnj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytnfifrxqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytoxuthzli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytpwacukjv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytrwbwweve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytspxbhanv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yttup.4nmn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytvclhqgwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytwaqhwpvf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yufcxoucfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yufptlqnmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yugusjduvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuhotfnrvg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuiooklo6778.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuiqwdendsi2312.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuitpawcjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuivvbfcrn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yukghzkmdy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yulidxywqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yunpqfufzs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuplteyoyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yupxrrxlfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuqdozxiwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuryo-anzen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yutourange.t.justns.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200060097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuuscodghs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuwtgxutpn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuwuovefdx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuxwfilcaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvcbktrvsz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvcxsqcxhm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvcybyazvq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvgltxmxwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvguehozzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvhfoyjgph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvhqgpliul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvhxznnkkd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvlgzpptfs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvobsbramz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvqxvkvesg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvszswvwvq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvtlrlrzqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvtlrmjmkq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvxneuspuy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywbytozptr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywigjpsqcs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywsrlcixew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywurtjmpmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywyimtvzbn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxaqzubroa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxegezaqly.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxggrycvpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxjyyxylxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxnjwyzdhg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxnrexcnjb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxojkngoxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxslmsntgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxtzzrtgrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxuxltnsir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxxxtlkcmt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxzqhvplxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yydjgccriu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yygctxtyvh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yyibozbcrt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yyjbspimod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yypvohmezc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yyrduqiasv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yyzbbeszyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzblgjifcw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzdpfqluee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzhbzjbqta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzkaevxkxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yznlcnspiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzoxasxlbi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzqcwksopv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzrmovqluq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yztngkgilm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzxgnergga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzzhmtazkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"z0naldigitalpichincha.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200060152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"z0nesegure-viabcpcontigobeta.englishtutorweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"z2tkui.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200060154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"za535.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200060155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zaajohabjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zaeciigqnp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zafrfdywmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zahal.naturalbeauty.com.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200060159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zaizglnlde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zamlqyvige.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zamwkdlklt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zaqfmuasvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zatmubphtm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbbtnytihk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbcdxylkff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbcrybcqhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbfprimgoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbhpgpugwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbitxkfdqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbjsxpyyuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbmasefbib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zboteomgod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbowxaye.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200060174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbvtxqhqin.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbyepvlpyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbymucakxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbyzvcugxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcfianbiwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zchzipsqfl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcihjyzptw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zciroternind2718.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcjuhuxhnh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcmnmdvqpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcnbugegph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcquktafzh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcqzjxjnyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcsjlnzcmh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcwpzffxlt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcyndededf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcywrblfse.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdaidryckc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdduhkuihk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdg.867nhmd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200060194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdhnwqkjbi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdjysqdqcz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdovapuvfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdryiotoix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdsopukmbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdzaypqror.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zealous-cliff-0a8252010.1.azurestaticapps.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200060201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zeii-egipt.bombsquadz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zeiron.net.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200060203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zelfoplossingsgericht-kvk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zemalidmio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zenithxr.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200060206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zepfybpyix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zerdgkvyhg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zerion-io.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zerione.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200060210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zerionio.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zerrion.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200060212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zetstabrig.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zevisyujof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zewsriorwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zezgukckzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zf7qb2k6cytqxgo2ih7n2jt5mez52twtiif33ap4eiroe2ohnalq.arweave.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200060217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zfepguvpft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zfgoripisf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zfhcfbfnps.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zfhocbsrkx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zfkfuixanj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zfnapgqlmt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zfssrreqcd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zftmomprdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zfxzgjsndy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zfzvujtkxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zfzwpjukam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zgcollections.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zgedmrpcxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zggdnbthwc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zggepsgwpq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zggsutcbcc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zgjgzcpyiz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zgjlewiakw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zgkjkwxzic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zglxauight.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zglyxdmjhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zgmgxutrwo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zgrzejcxtb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zgugylxsqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zgwvslowyt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zgxhc.ytcrt17.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200060243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zgxzuhwfgd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zgyzxkdpev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zgzsaeelao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhakvdoyrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhdeetoyke.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zheard.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200060249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhenerts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhmlgzpwvl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhnezkgiav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhnygrahfi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhqizbysav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhqrvibait.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhrcivxdxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhrqwjknjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhsvhbmxdx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhsxfsobmi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhtatd.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200060260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhubwwkwvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhugkpkhac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhxnvryctr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhxplzfqwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhyudbjbdviua.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200060265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zi0034034323.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200060266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zi992883923923.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200060267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zidwxuojff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zifpsxkiay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zifqporqvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zihwemuxyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zihztkczzo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zikwazxazb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zimbra-customercare.berthascholarship.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zimbrafaq.instanthq.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zimlhlcvca.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ziofhkpxeb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zionsnfxlj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ziosbylvpz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ziqyennsha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ziryyhnnhz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zitnqydwdi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zizegscuoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zizzacfgsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjgwfskkbw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjlilyttvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjlskxcbem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjltviagoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjnficitww.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjnlcfddjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjvusiopuc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjwizjzlzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjyflywsqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjzvxxkqud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zkadxdghns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zkbbku.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zkbccphgab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zkbkazz.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zkbvzdhkco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zknhxvxsso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zkrsgisknx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zkxbniosfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zkxgrroban.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zkxkqersrn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zkydiwvala.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zlajuqrixk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zldlzhiugz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zliblfclya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zljgtbeihp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zlkxxcooan.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zlozxxtlno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zlrcyleklt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zltaylmavf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zltrdrhodm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zlumrxhrph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zlxpucbtkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zlyiltzhat.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmeqstds3oun.usemoralis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmflapvkcr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmfqnbxhfq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmgjyjstjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmhwjevres.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmiacewldt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmiedguquw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmlumkglur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmnnxgeelr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmpkelqagt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmtbvvwqfs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmuzezbqsn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmweeurste.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmwivajhut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"znazmmhbff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zncwunkoch.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zndjtswkcp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"znefjgcxhh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zngjofmxui.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"znibotgkrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"znizzmqdls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"znknbyfiaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"znnhhgwade.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"znuntomyzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"znuseiekdn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"znzfevzeik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zoapveavwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zoawbukdsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zocgohljno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zocjulzfnu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zoegcieaso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zofpeveqie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zogojxcuon.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zoibbroysl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zoilhlfvza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zoixtwnzcv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zojmaqb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200060354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zoknoodlehouse.com.my"; content:"Host"; http_header; classtype:attempted-recon; sid:200060355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zolppxedlf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zomarudxdu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zona-segura-prestamos-banbif.productos-en-linea.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zonaensengura.vvvvwpinchincha.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zonaensenguraespinchincha.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zonajsgds.ingresando1.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200060361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zonasegurascajapiura.hierrostely.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200060362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zonasegurascajapiura.lojadecoroutlet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zonpjwqqzh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zooxbwxrej.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zosjumswop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zouqopovui.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zowekpbojt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zowvlgpnxt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zoyodetxze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zpajsspkkn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zpbtnaiyqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zpenmsqqgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zpitaschsl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zpmdoycbnw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zpmmxdhftl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zpmtniznwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zpmyzdbhkx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zpnnmcmfxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zppcehqvml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zppdnziead.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zppsazbamb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqeuoselnd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqfoqrlmtp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqgortuxbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqithlatux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqmlp-taaaa-aaaad-qdmsa-cai.raw.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200060387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqnrhefacz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqpctfvlyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqporanmrq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqqfuehser.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqqpgukrry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqsurgzpxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqtbsfykkn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqtdbkijdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqtqwohmbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqtxblteky.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqxyjheryx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqzsewgzqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrasfoanbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrctfczern.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrdaccrtpj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrdqmaavvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrgqsypttb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrjphhwkbk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrogirczxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrpskzztmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrrbtqqroq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrrqffobgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zruosfherl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zruvojkbkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrvramhcaw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrwsx.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200060413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrzpssbnvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrzxklvtuo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zs8scy3g487324cyg23c.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200060416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsgsayoqwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsgxh.supibao.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200060418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zskaxmmciv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zslckhrmvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsmqfbbidf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsngmaelgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsoqsjcyyu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsslfwukbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsstittfkr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zstizjgvqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsvxiijtab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsznvoiaql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zszprakbhi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztahsgcqhr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztanltldyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztbzifaylh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztdqrqyqgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztfloczhua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zthasibyzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztiafubuzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztnlrvsmny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztowf4.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200060438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztpgfncnxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztpsjhtvmw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zttnomwmej.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztvxukxoov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zucmpnjves.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuedqeveat.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuehitemyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zugang-bundesmini.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200060446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuhmvmvcdh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuhrpdzzxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuiniptaos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuixrsrguy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zukaagvtjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zukukapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zum-gutmann.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zumjdciqli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zumqkwcdle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zurbrioerf.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuriescents.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zurotqqvtw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuudicrlcl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuvasqgyqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuvrkldwcy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuzcgziijm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvdgghjytwer.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200060463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvdmuoqdmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvento.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvgaiguhhk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvhkmkpbqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvkvkjfvep.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvsaxhldwm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvsvfasfweg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200060470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvujkfdhok.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvzgukocwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwdxfaflyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwiulcuyji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwkuzinuzw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwllbbppmn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwlnozhbvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwmclaukka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwnlcpzlyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwouucddjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwsfnemtev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwulhsvmvl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwwasurmjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwwchoxret.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwwempatgk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwxjkexgyu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwzgvorraw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxexafyaqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxgfvckjrq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxigflunrr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxjlrbakta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxnpbjlqtt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxthgocqoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxvfyqsbmv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxymzllxjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxyyleerdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zybdyisism.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zyccmocddc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zyequujivh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zyfqddjttj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zyisgnvgka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zyncmhspyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zyokkzjpqo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zyrpsnexzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zytutbzsjr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zyxscliqki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zyxxxkxxwj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzakhsrvod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzcskfjxom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzdcknjacx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzekbb.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzexwudwev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzgbdfdywq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzgeufvnyh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzkbkna.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzkbks.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzltoqafgi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzpvkgsazi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzqhyloxfb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzrslywryq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zztojftxgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzuwxnhfxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzvehtlcgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzxegowtyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzzcgwyqhg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200060525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bros/"; http_uri; nocase; content:"0nebet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v3/signin/identifier?dsh=s-1174086285:1663768901653050&continue=https://accounts.google.com/?&followup=https://accounts.google.com/?&passive=1209600&xrealip=107.178.232.168&flowname=glifwebsignin&flowentry=servicelogin&ifkv=aqdhywpkpuruezswbgirykb3yyagymdwlqwgul_ed0zafqucbpfdpgg6y0_fovmsudoffvmjctr4sa"; http_uri; nocase; content:"129.226.211.22"; content:"Host"; http_header; classtype:attempted-recon; sid:200060527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v3/signin/identifier?dsh=s1711288546:1663767905025042&continue=https://accounts.google.com/?&xrealip=138.199.38.132&followup=https://accounts.google.com/?&xrealip=138.199.38.132&passive=1209600&xrealip=138.199.38.132&flowname=glifwebsignin&flowentry=servicelogin&ifkv=aqdhywpnna62nbnsih7r6ocsf147jlmhcxija8r95tbnhptxsdqevmokh8i0wok5acqs9amdn2k8"; http_uri; nocase; content:"129.226.211.22"; content:"Host"; http_header; classtype:attempted-recon; sid:200060528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/o/s!bcxisnewh_cnvrnkj_y2f1eccpwq?e=gvtbd8pbpealap_ppbzgja&amp\;at=9"; http_uri; nocase; content:"1drv.ms"; content:"Host"; http_header; classtype:attempted-recon; sid:200060529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/u/s!asazsxxj27tygrqveud6b2tyextk"; http_uri; nocase; content:"1drv.ms"; content:"Host"; http_header; classtype:attempted-recon; sid:200060530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/w/s!aqb1sjv7nuauan8etr6o4rb2z-8?e=siebms"; http_uri; nocase; content:"1drv.ms"; content:"Host"; http_header; classtype:attempted-recon; sid:200060531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/go/?www.orange.orangao.c%cd%8fo%cd%8fm%cd%8f"; http_uri; nocase; content:"20khvylyn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bbva/592cf4/425bdbd3-91cf-4e9f-9498-7a06b3ad75ec/?test=1"; http_uri; nocase; content:"28ecne20f9u.securetnet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/11wyd"; http_uri; nocase; content:"3c5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6pcza"; http_uri; nocase; content:"3c5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e9qog"; http_uri; nocase; content:"3c5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ijuwm"; http_uri; nocase; content:"3c5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kmvno"; http_uri; nocase; content:"3c5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/o1vf4"; http_uri; nocase; content:"3c5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/themes/3rdst/8-login-form/"; http_uri; nocase; content:"3rdstreetmarket.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/themes/jarida/includes/widgets/stuff/login.htm"; http_uri; nocase; content:"3rooodnews.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v3/signin/identifier?dsh=s-1861846371:1663767905238112&continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowname=glifwebsignin&flowentry=servicelogin&ifkv=aqdhywr8afpwjwhmzeh8vh6dxpg34whyhv2_8x6wjogvknbvddktansdu1ljwohwro3ijrzjqvyb"; http_uri; nocase; content:"49.51.43.12"; content:"Host"; http_header; classtype:attempted-recon; sid:200060542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/wauth-login-present-origin-cob/"; http_uri; nocase; content:"50in50marathonquest.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l0/https:%2f%2flnkd.in%2fgw2x_btv/1/01010181d5b4121d-ad8975c1-fc53-41b2-bad9-ecb97743ffd4-000000/p1odbvtfelzzx9amvwo_h954np8=278"; http_uri; nocase; content:"7b631qxp.r.us-west-2.awstrack.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200060544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l0/https:%2f%2flnkd.in%2fgw2x_btv/1/01010181d5fb3b48-737ccb85-d5e2-4457-a851-976cc0f4bb46-000000/7s-v3-kzdc4bgzegonycqrjgcoi=278"; http_uri; nocase; content:"7b631qxp.r.us-west-2.awstrack.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200060545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l0/https:%2f%2flnkd.in%2fgw2x_btv/1/01010181d603af46-160c71a9-c106-4e8a-8d41-5f8c8fea17a9-000000/c9_d4zic3z0jjatwzj75zswof1w=278"; http_uri; nocase; content:"7b631qxp.r.us-west-2.awstrack.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200060546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l0/https:%2f%2flnkd.in%2fgw2x_btv/1/01010181d641f3ae-89c7fa59-82a2-4f6b-b2a4-cdc8626f95fa-000000/hyy7ncrmtxieavrn3px4goieeos=278"; http_uri; nocase; content:"7b631qxp.r.us-west-2.awstrack.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200060547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/assets/css/api.php"; http_uri; nocase; content:"99mbet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/assets/img-temp/api.php"; http_uri; nocase; content:"99mbet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/assets/js/api.php"; http_uri; nocase; content:"99mbet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/openpc/directlogin.do"; http_uri; nocase; content:"a-q-f.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/id_1ftb3gemh_1ogg?utm=abcsubmit"; http_uri; nocase; content:"abcsubmit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/id_1ftb7k8ik_11di?utm=abcsubmit"; http_uri; nocase; content:"abcsubmit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/servicelogin?passive=1209600&continue=https://sites.google.com/view/viewbill-bt-1/bt&followup=https://sites.google.com/view/viewbill-bt-1/bt"; http_uri; nocase; content:"accounts.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/1lordman1man3/oscman.html&followup=https://storage.cloud.google.com/1lordman1man3/oscman.html"; http_uri; nocase; content:"accounts.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/1lordman1man3/oscman2.html&followup=https://storage.cloud.google.com/1lordman1man3/oscman2.html"; http_uri; nocase; content:"accounts.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/appspotv450i7r8h9vf9y6yt8uiuft58f7uf5yye36u0jtyf78uuyfyy/index.html&followup=https://storage.cloud.google.com/appspotv450i7r8h9vf9y6yt8uiuft58f7uf5yye36u0jtyf78uuyfyy/index.html"; http_uri; nocase; content:"accounts.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/employt44to49cclrlolcrl94lnlxo.appspot.com/index.html&followup=https://storage.cloud.google.com/employt44to49cclrlolcrl94lnlxo.appspot.com/index.html"; http_uri; nocase; content:"accounts.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/maintainancecomponeta.appspot.com/mineindex.html&followup=https://storage.cloud.google.com/maintainancecomponeta.appspot.com/mineindex.html"; http_uri; nocase; content:"accounts.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hipercard/?userid=&amp\;uri=8qitdq&#43\;xfqvlrupbz0/u38ci0dgknqgrp8j63d/bt1e"; http_uri; nocase; content:"acess4r-luizaftura-xvt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hipercard/?userid=&uri=rwjn+z4bhropbzmmsy2tyansx2qecsmxf2sdtmkbc/m="; http_uri; nocase; content:"acess4r-luizaftura-xvt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/en/bellcocreditunion/"; http_uri; nocase; content:"admin.fifoundry.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200060562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/public/backend/images/team/salamonca/"; http_uri; nocase; content:"adultadlist.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"aesoioesn.aseoseiseaccn.uqmzwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200060564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"aesooesn.aseoseseaccn.uqmzwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200060565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"aesoosesn.aseoseesceacn.uqmzwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200060566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/#redacted@abuse.ionos.com"; http_uri; nocase; content:"agblxwoyweqsdves-dot-mirm-git0-ogix-ogoa.ue.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2005/03/colourful-life-of-aij.html"; http_uri; nocase; content:"aijcs.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/svxc/index1.php"; http_uri; nocase; content:"aiousolvedassignment.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yonetici/newdocs/gdoccc/"; http_uri; nocase; content:"aksehirevdenevenakliyat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jp"; http_uri; nocase; content:"alejsrt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2vka6"; http_uri; nocase; content:"alturl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/zvgft"; http_uri; nocase; content:"alturl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pc/amazonall_signin1.php"; http_uri; nocase; content:"amozon.co.jp.llhgmt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2409d185-0697-4010-b988-2a5310917-2409d185-0697-4010-b988-2a531/index-01.html"; http_uri; nocase; content:"ams3.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jps/webmail_reset.htm"; http_uri; nocase; content:"anekaslot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/construct4950/middleton.html"; http_uri; nocase; content:"ap-south-1.linodeobjects.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/message/c3upfo4mvzsgg1?autoload=1&amp\;app_absent=0"; http_uri; nocase; content:"api.whatsapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/s/x6agocx9zvj049azirk4aw3xrqdedqhl"; http_uri; nocase; content:"app.box.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/s/ymr0ltw3hmn8icxebz16gjhcyhqa49w4"; http_uri; nocase; content:"app.box.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/document/27bcdebd7736cefa2575f4f56d1439096536f544"; http_uri; nocase; content:"app.pandadoc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/064ca177fcb7d3b79b1a0de5fb00ade981aeff90?"; http_uri; nocase; content:"app.pandadoc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/26bcb52213a6d759d76014ff4e11c37cae6ae56c"; http_uri; nocase; content:"app.pandadoc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/27bcdebd7736cefa2575f4f56d1439096536f544"; http_uri; nocase; content:"app.pandadoc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/abg7_xbalh"; http_uri; nocase; content:"appurl.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200060585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kektfripag"; http_uri; nocase; content:"appurl.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200060586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/en/us/account/main/dynamic/iamlrr/controll.php"; http_uri; nocase; content:"atflt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wordpress/wp-admin/user/public/tolbox/"; http_uri; nocase; content:"atlanticcity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/shop/v1/?vn=ctv-tfnlinkbot-pc4-cos-usr-bdl2-alt-wrl-wrle-cc1-cic-cf4-dpf&chatmessage=false&slidechat=false"; http_uri; nocase; content:"att-promotions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.k8jaf9u.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200060590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.6yajqmu.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200060591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.q14tx8u.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200060592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.k8jaf9u.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200060593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.6yajqmu.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200060594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.xogutju.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200060595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.xogutju.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200060596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.k8jaf9u.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200060597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"azeioaz.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/index.html"; http_uri; nocase; content:"baovesusonglcxt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/js/api-gantengz.php?key"; http_uri; nocase; content:"bardestani-carpet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/css/apicuy.php?key"; http_uri; nocase; content:"bardestani-carpet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/themes/chpost/ch/?pwd=post"; http_uri; nocase; content:"bestdoctors.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/themes/chpost/ch/clients/details.php?verification#_"; http_uri; nocase; content:"bestdoctors.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/ngg/wb/index.php"; http_uri; nocase; content:"bikeboat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?bfp"; http_uri; nocase; content:"binancezh.sh"; content:"Host"; http_header; classtype:attempted-recon; sid:200060605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:w:/g/personal/mtestan2_binghamton_edu/edp3org-ymjbpyq-3xfgf5ob4x8g4fhb0siyy3cfhyg08w?e=4%3an9hzlk&amp\;at=9"; http_uri; nocase; content:"binghamton-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/h67yt2"; http_uri; nocase; content:"bio.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200060607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fuvgz"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200060608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fvdca"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200060609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fveke"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200060610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sicurezza-hype-it"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200060611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3ijwsm2"; http_uri; nocase; content:"bit.ly."; content:"Host"; http_header; classtype:attempted-recon; sid:200060612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2zejaht"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/34hdmyt"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/366qkes"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3btlfer"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3ccqacg"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3dj0r1p"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3e8kw2o"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3jkf6va"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3kueruz"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3kworri"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3lamwcc"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3ldovbh"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3pvc7vy"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3qplrme"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3rwxwd0"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3wdi2jy"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/banbif-pe"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bcp_wanuchay"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lmterbank"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/shpee_coins"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tranferetenida"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/transf-retenida"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/udmcmadcracked"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/verifikasipemblokiran_id"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3g1epw3"; http_uri; nocase; content:"bitly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3jrtmmu"; http_uri; nocase; content:"bitly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?redirect=utqb"; http_uri; nocase; content:"bitly.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200060639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/utqb"; http_uri; nocase; content:"bitly.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200060640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/accounts_blackbearcc_co_uk/_layouts/15/onedrive.aspx?id=%2fpersonal%2faccounts%5fblackbearcc%5fco%5fuk%2fdocuments%2fngb%20urgente%20substanti%c3%able%20update%20%5f%20voorstel%2epdf&amp\;parent=%2fpersonal%2faccounts%5fblackbearcc%5fco%5fuk%2fdocuments&amp\;originalpath=ahr0chm6ly9ibgfja2jlyxjjy2nvdwstbxkuc2hhcmvwb2ludc5jb20vomi6l2cvcgvyc29uywwvywnjb3vudhnfymxhy2tizwfyy2nfy29fdwsvrve5as01b19mukjbcutzeunhv3eznw9ccfbtmze3b2fsrnrgnhpzuenbvlfiqt9ydgltzt1tqjzyquroodjvzw"; http_uri; nocase; content:"blackbearcccouk-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/en/balances"; http_uri; nocase; content:"bnbchain.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200060642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/en/trade/now-e68_bnb"; http_uri; nocase; content:"bnbchain.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200060643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/77volr"; http_uri; nocase; content:"bom.so"; content:"Host"; http_header; classtype:attempted-recon; sid:200060644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?aplicar"; http_uri; nocase; content:"bonomequedoencasa.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/digital/"; http_uri; nocase; content:"bprhost.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/verify/m&t/login.php"; http_uri; nocase; content:"brauhausschmitzoctoberfest.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/login.html"; http_uri; nocase; content:"brooksshoesoutlet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:o:/g/personal/richardmcc_winebinends_org_uk/eqv_1b7hjo5gngtopu852xcbwjtdbkujue4wq9ljz-xq5q?e=pjtgzh"; http_uri; nocase; content:"bt843843p1-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jp"; http_uri; nocase; content:"bzvwtofbsrtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200060650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:w:/g/personal/dkapaon_brandeis_edu/es1enxze9_xblrutnfjfpm8bbxkssfvrpe6cnirweqaapg?e=4%3afdar13&amp\;at=9"; http_uri; nocase; content:"c569257608da4dcaafbc-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/svxc/index.php"; http_uri; nocase; content:"cannacbdoilrx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/home/payment.php"; http_uri; nocase; content:"carepath-recruitment.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200060653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wordpress/wp-admin/css/colors/light/webmail.thurweb.ch/login.html"; http_uri; nocase; content:"caxita.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200060654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f/9245db2516febd1d3c13c0a90f65c615"; http_uri; nocase; content:"cbn.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200060655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f/fa15a875fac963541c5da50d05c179ac"; http_uri; nocase; content:"cbn.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200060656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"ch-299199919900.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"chase-help-support-locked.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"chase-onlinehelp.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2021/02/blog-post_12.html"; http_uri; nocase; content:"chronopostvalidation.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/proxy/rdh-rjsrv9zzrx57iscgov74o1gka4qjdfj01qr7v8-pkjgyvn50tivt7pzqgm5kuqdmonqle3f8eq_t8f4xl6jdozabmf2lxy-888ai8hdji633rg"; http_uri; nocase; content:"ci3.googleusercontent.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/proxy/djc3ckf7jcnj8l0duyaqyjwffeskzbccy9spjiauj_jwrplgw0ahyaf1xozvm6n_fjn8q1-2vkhqqujjr1en3qej703lyxxujt6tto-ttwsl6hgsggp3ehcc"; http_uri; nocase; content:"ci4.googleusercontent.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/proxy/zjba9cvtmkfnoveyofx6gqong0kqi3s69d9o2y32fmu_gankb59tj-rb79bolx0bwbsemnonfhh2esy9olfdp-20gybztkzstfhfheqrrjuefxwiwkqws29wxm6tdobikwz-qkzfphpaldfr"; http_uri; nocase; content:"ci4.googleusercontent.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/escl6%09%09%09%09%09%20%20"; http_uri; nocase; content:"clck.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200060664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gwg8w"; http_uri; nocase; content:"clck.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200060665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yzuft&post=665308711_32&cc_key"; http_uri; nocase; content:"clck.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200060666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?qs=6541641088c869552ced792d84ee93eabf075e23cd5eba83a7d07a40ad9cf2ce36c931984719b9df7de658999defbc87f999ec46970a0280"; http_uri; nocase; content:"click.message.fruit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2sm/www.facebook.com%2fidmeinc%2f/nk2-ri4n/weg/x37pnvbmkp/axzhlmv4cglyyxrpb24unjbfzgf5cw"; http_uri; nocase; content:"click.pstmrk.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200060668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/text/tab/dab/conect/1c7c5"; http_uri; nocase; content:"clickforcontent.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/text/tab/dab/conect/b8f9c/"; http_uri; nocase; content:"clickforcontent.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fact-comp-h5j6k7j"; http_uri; nocase; content:"clickmetertracking.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafkreidqr7tw7chuyg7pf3obkufp2hultdpoas37vnnofqes7nzkq3kqfe"; http_uri; nocase; content:"cloudflare-ipfs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/config/webmaii/error.php"; http_uri; nocase; content:"cmark.mycustomerconnect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/agt12/outlook"; http_uri; nocase; content:"cognitoforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/automotive4/hrcompliancesection"; http_uri; nocase; content:"cognitoforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/knpdf/ussecuredpdfdownloader"; http_uri; nocase; content:"cognitoforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/en/"; http_uri; nocase; content:"coinmarketcal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pages"; http_uri; nocase; content:"commbank-cancel-payment.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/#/"; http_uri; nocase; content:"comusoportecam-produccion.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/h/y/b6733bec265eb698"; http_uri; nocase; content:"confirmsubscription.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jp"; http_uri; nocase; content:"coppergaslight.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?.rand=13inboxlight.aspx?n=1774256418"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?.rand=13inboxlight.aspx?n=1774256418&amp\;email=jackdavis@eureliosollutions.com&amp\;fid=1&amp\;fid=4&amp\;rand=13inboxlightaspxn.1774256418"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;amp"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;ampopensource:observable-35835700-0d08-4c25-a188-b8312ba00a941067515"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;fid.4.1252899642&amp\;fid=1&amp\;fav.1&amp\;rand.13inboxlight.aspxn.1774256418&amp\;fid.1252899642&amp\;fid.1&amp\;fav.1&amp\;email=&amp\;.rand=13inboxlight.aspx?n=1774256418&amp\;fid=4"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;fid.4.1252899642&amp\;fid=4&amp\;fav.1&amp\;rand.13inboxlight.aspxn.1774256418&amp\;fid.1252899642&amp\;fid.1&amp\;email=jsmith@imaphost.com&amp\;.rand=13inboxlight.aspx?n=1774256418"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct?email=jackdavis@eureliosollutions.com"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/images/verify/update/y.html"; http_uri; nocase; content:"creativeingredient.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2011/02/habbo-crediti-gratis-sicuro-100.html"; http_uri; nocase; content:"creditiperhabbogratissicuro100.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:o:/p/clord/eo0lfhtannnjiehfwx2q5o8b_lkpqdhacft8rkvqad2nqg?e=5%3aq65oiu&amp\;at=9"; http_uri; nocase; content:"curtislibrary-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"cusstomerservicee.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jvkvxfj"; http_uri; nocase; content:"cutt.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200060696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ebvdr"; http_uri; nocase; content:"cutt.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200060697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/webmail-rd1278/index.html"; http_uri; nocase; content:"danashaymarketing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?d#wallets"; http_uri; nocase; content:"dapp.accessactivationbot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hotsite/inicio?utm_source=sendpulse&utm_medium=email&utm_campaign=2021_desejoourocard_ciclo_6_opt-in_sem_opt-in_varejo_%235om-p2_p8_p16_p9_frio&spush=ywxjyw50yxjhy2fzc2lhbmu2n0bnbwfpbc5jb20="; http_uri; nocase; content:"desejoourocard.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200060700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/online/showdocument?documentid=1fce937a-ba39-4053-a83a-f07711ad8efd&invitationid=82f3e840-cd11-4da4-8579-304bd7e930b0"; http_uri; nocase; content:"digisigner.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7p8ma?confirmation"; http_uri; nocase; content:"dik.si"; content:"Host"; http_header; classtype:attempted-recon; sid:200060702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dirbn"; http_uri; nocase; content:"dik.si"; content:"Host"; http_header; classtype:attempted-recon; sid:200060703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/iavat"; http_uri; nocase; content:"dik.si"; content:"Host"; http_header; classtype:attempted-recon; sid:200060704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ot6v7?confirmation"; http_uri; nocase; content:"dik.si"; content:"Host"; http_header; classtype:attempted-recon; sid:200060705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tpjda?confirmation"; http_uri; nocase; content:"dik.si"; content:"Host"; http_header; classtype:attempted-recon; sid:200060706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/w9smu"; http_uri; nocase; content:"dik.si"; content:"Host"; http_header; classtype:attempted-recon; sid:200060707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/14038722/"; http_uri; nocase; content:"direct.lc.chat"; content:"Host"; http_header; classtype:attempted-recon; sid:200060708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/14523597/internalrevenueservice"; http_uri; nocase; content:"direct.lc.chat"; content:"Host"; http_header; classtype:attempted-recon; sid:200060709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?url=https%3a%2f%2fpushrushed88.duckdns.org%2fredirect%2f&key=ulc_4epigzz16uwfb5b_yg"; http_uri; nocase; content:"disq.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200060710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/document/d/e/2pacx-1vszcwxk6nifthkg32wjxfjgq9yc-jjujkbsumqeeau8uw7xkcutyp0tbgux2mvwu8iqfrxxlunajob8/pub"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/document/d/e/2pacx-1vt_xl-m0ff8yqqhzhgseahgwejo0znh9re6w0qvgbe0qfe084hrebjjg673htphdnvbcdnq6agehncq/pub?mobilelogin"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/document/d/e/2pacx-1vth3iya0ov7p49rk9ejozgqnueuk8fna2mky389hertlwx4mnoyhl1mlhnwbz8sxnsqtk8i5uysmq68/pub?embedded=true"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/18tk5qmpccb5nygfkfeo9xc5qowvffgdjvy52swoyhd8/viewform?edit_requested=true"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1_ecy_td-z_1y0ex1fkqvhikwpnujs6s4dzer66v4tp4/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1aegowsjpbld0rvgivurbyfidcqlg5v7z9i9ylo3bey4"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1aegowsjpbld0rvgivurbyfidcqlg5v7z9i9ylo3bey4/viewform?edit_requested=true"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1casphevkfdaz2okqj70wdai3pdwwg1weh_rpk9v0z3a/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1g1hatisjxswx8aoimoehyj2gumqe6oqb8wczylqpiou/viewform?usp=forms_home&amp\;ths=true&edit_requested=true"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1gs07chp1nmdlfpzzgcswjfzjtek057wtnfs8ws_jbky/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1htjqwgpnkonvm8dbgasjax8mkpu_pvnj0c71ttkfpn4/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1quv0zklyhgw_4y4pfincdtzmt6qim5qffhfuxcb4kl4/viewform?edit_requested=true"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1xqimvjghvfozh7itbnfykzhs1njn2ib87dj29qowr2s/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc-dgjx5xrdu-0vsevx2bd16zlt6rydibvfdsgrqlxld4lozw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc-nv7qlz6jg_y9ze5k9ds_kzo8hyelurb5j5veve1q4jkiwq/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc-xysogohjsbzmcnoded8ooar2gz1c5zxobgk8envh3jbpow/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc0o4vlkf8kr3nf2m594obfauspo2orpvqmat7dmhk272ex3q/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc0yyqlieizg0nzouznvhsjfags1h9qi5hpdw3qlgbivm501q/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc1sinntdpgo5c6tz6crpbkhdb59q9y8mjtcwfr5v93buo9wa/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc4bagzjzmstbnjhy7zpy5zsx-xrn7reoouolv54luk5tihha/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc79egzgguu0w2cjb5nd_2esaw6i6ngl9fzq5pubqdfediqja/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc8ivrcjrbnxs_ckmgkrmk1unmuijsqwkbudbmayumt3e438g/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc8uc5aztlek3s6dqtk1etorhez5m2yvubyw5qmfkpisrelcq/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc_enqwhhv1jnvzy55mb4ghvjd4wcz9plnolh2eoitk7qgbra/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc_f0pxmnwzrtbck6u06fdzocmhgzvjzlc8cu7c9b456fhccq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscaoiohhbm7suyz9ol9o9ueunbxn6donxrfjge2cevdw_8jmw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscbpunbcb6ubfnwjo9jol26cjvjjsvpzkz_wb9exxt9c7erdq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscbtba5srjedev4uvqq49pt3recywqah-ar5szplndj-dxhgw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscc98m5fw4ifog0zeiuquxitizmisrgsdvyxvtxsppunpkwzq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscckv1-rxhipcmrhnwfvq2lhuxx18nzcm1e7e0oz8ienixtgw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscclmqirehqtkm3vl4u9gm2zv6xfvrddbrgke9fmsfujqbboq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscd8t8sjgxqrsa6dq5kjpmrpsxkvi4bl38sfdu7wa3sl32elg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscda1to5ru4sjeeujg3ki2bimklprvsec6u43kpvhbfyhrldw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscda1to5ru4sjeeujg3ki2bimklprvsec6u43kpvhbfyhrldw/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscdct8mue2qq3syjr4tnntol30jfdk8vwpco6yjh7dxnq5nyg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscdct8mue2qq3syjr4tnntol30jfdk8vwpco6yjh7dxnq5nyg/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsceoxsfawdsbd2r-jk2sppywnv1bchzjjcw2xkcj7oqkwqriw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscf9u8nrld-zvu6clr4jcwnw0buqrykdldtzoullbxy8kc1ta/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscfh2njwrve6_rkxxy1yz83keoeekd4maqcnd-ivq7rkg0uca/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscirilop6_iti0zvvrlsbk8zfaeo-f10otlhj9k5liyervk4g/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscjsewetq_v_cbpyh9dzjwsaoldxz2zx816022wp1vej8gv1g/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscjtat4fmstlxz3hbfkg4qyi-epfdmun7_avcqwvgscoydytw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscjvnhykksssaw-kycyrl6ywg_r3fdjuyqhk2mrmxcpgwfxoa/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscmzyecgbuuccfs_5e5axn9hpruzskqmvseedm0xz1qrqb5vg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscn6xxq_xvtivggy_4rkibou1i27e0kpiimikafpaavki1vsq/viewform?usp=send_form&usp=embed_facebook"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscndiqyfu0gtgwomcwsy-8nadvzgljrpdhkv6pedgh0avniag/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscpilmb3qeojpnro6hw5ekpw1g4ub7j7feusjzsmq9obnoq2g/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscqbbsvkpxnasqgeazpzwxp1ln7qzdurt-nqn4azqa7q14euw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscqstjp2am_gdxb3vmgu9lkv6l7jho80rmyd7lmujoarxrqjg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscrmsgjymaojts0bfneswvnfekiw6zya5rzyqoa1ydp5wkcrw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsctmueyv-hoo8lvwjhptfnaht4ymn8cr3tnftbfnqmjb6xpwg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscuttypbph1iazuis8aa6xvrlmagwglmdcrrg8g2oymskvbva/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscvqmhqgwbubzxdynzgvlbmmziyagdiadz2eyhc-s-ro8ndfq/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscxgbsqs0_gphf4vziykyu_g5rgytw2s9fir3lyfar7kaixew/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscxgbsqs0_gphf4vziykyu_g5rgytw2s9fir3lyfar7kaixew/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscxktatyielmhqxqqxtesa1ih5armwcrqy5r9-95cslplt5rg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscy0frglrf-omcz0vkzncs5vnnwg-sbnzhqxv7fhse6pfwf7w/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscywhsspi2neolntfe02hpq6jqilhxprhi_z58uj2lfqortyq/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscz4uf8dtvwhgxggkzsbbhjcgu9npgc6agxpy5o2fwpo6tv5q/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsczswa80hlvnpkqiuayjwbf8ha_rqzov0iiz18iixjatmqk9g/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd-1s4o-n_p_bhfqqs2agxxx4erjuvj6e5pwndokq5tg5cnzq/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd-bdmru2lv7bv1fk1mwwkxyrvf6uyx11zlly9k0j2gdse_rw/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd26pifmynauv34el3gdnx3yzwdue9bannzsfcy7bdkyfotaq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd28bt51jk8onxnbburwsyu2xlc52wmdkgisnqrkvotohz7mw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd2nideystvwbbe_ai_glo93rwmxwkf_ok7sl_dvxqtacpwla/viewform?pli=1"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd2ou8uvxtpuhvfme1q0hzpsnfnwg-nfno2_niqp6fzcjobog/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd3x6brnru3toiionptordwmc4zorxcky1ebpmeg6bb4jfuca/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd493if3zxczsfqzw_g592pog6wbhptgrci8sbhji11gq312a/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd7jgegqudsjg7blscqgfvdftyvlno6xreg6wjuxl0hnfbwtw/viewform?vc=0&amp\;c=0&amp\;w=1&amp\;flr=0&amp\;gxids=7628"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd8vkw5fxeroe_pxa7n5cdfpukhahbg_7k7sg0iuosh_xsyoa/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd9poeb_wmgffgg8taw4z_np0kdbo32gr35k1zxizj7lcdela/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd_c4wpt0zzouwt5lr9p5kn5cylz3ananv1hlix6u_h36w1rg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsda4flfi-1_gvwqnbb1dcxz_mb5omo9t2oc-vslzfgh6avrag/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdbgprbyowwcugqslasnoo-sbqcrgi6ppycsytvsw2_dwfeug/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdce9c1bqexlzlu9rojtuwtaatyeeshywbkmuiobrw_a-_mga/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdce9c1bqexlzlu9rojtuwtaatyeeshywbkmuiobrw_a-_mga/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdcga7ojllxp3z9puyfumhvn7klcijhty86bmhawtv5r6wwqg/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdcznggxnwia2ct8kmxid1tdqhgerhnmixukxuj7nmq1lqsma/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdf04avkjwvete8rj-wa3i7u6_8-orwqu-c-owvgb0nrxumga/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdfarxg-0eurkyimsg-ukgl4mbtgvwfhe1wzbdxmb7oaosnyg/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdfyxb1kjjvkaiwbbpbgr0dfaq1xx2ehhzbxnt3adndssy1yw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdfyxb1kjjvkaiwbbpbgr0dfaq1xx2ehhzbxnt3adndssy1yw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdinjm_qvdbv3roybqi073rm1pujmrrs7lid7c3qk-4xwweew/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdjmguhf2gu58xprr02lay_fc7kwixkq5zmtsn-5rgblqhbiw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdjmguhf2gu58xprr02lay_fc7kwixkq5zmtsn-5rgblqhbiw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdmjjljjfmjeijeyraxfm6pzupdbvoie7d_ussaqgqu2jh7zq/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdn6j3pmzbohssod769dzdjgkzhq9gt0czpk41k7ovrh41rkw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdnega_6c_pz9_q9ep9epm4iwqfsrxqsnaz-j9dyldimaoocg/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdplfokrnpmrpcrkjrxtvb7hv0nyzfocaudzkgzrftfbumaiw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdplfokrnpmrpcrkjrxtvb7hv0nyzfocaudzkgzrftfbumaiw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdqupro5hny5wbr5o5logbzdfh19mlw8vggtnzxrouoyvzkog/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdrk4xndjat7qhzawgsc96chkgkg66dcwrujwfkgjhzkmzhqg/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdv5owjshz-50lp-lmzff4i2z0r9sg31mh9_7b51rt-2ixoew/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdvwkczn_rxvn1522z1mcojbs40ymrctyizpyuv72_0wbypgq/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdwbz5hapgqojwjyndeeyjxamg0wnaj3kolh3fb6xf4c-fxjw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdwbz5hapgqojwjyndeeyjxamg0wnaj3kolh3fb6xf4c-fxjw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdxkjfhjk2jl99royttlqooscpgo3r9kauddp0idc_ih1g4ug/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdxm-rwnv41p3wdcbtetukrctoakvuoe1h_uy8jgnxy7kldza/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdxupqc45v5krv3e0skzu03cm214ktma588b8afg1stpesclw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdxupqc45v5krv3e0skzu03cm214ktma588b8afg1stpesclw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdy1071rbhheyidjzo6fw5busqot5eunllw_thawo6udamfaq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdybqflfptobqslhflytic3g936bnojaljztk6ct1d5mjvnnw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdz5olqkck6id4jh4_uiuejnndrt4qwgs8wpqtdfqqtvgsqbw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdzrubbm3nrqdzjs6q7phutjgmn-dm8zquphjg9ge31q7bdhg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlse0wzdylvek6cpem3mb8zeny09jij27yj-b1p6yytyue-1rwg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlse3-zgmg83lctfks0egmambwonybkscrvxix--n1azwngkphg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlse3ukgwguotprcg8cfwp4kxwz64r5ogqq1j_m4ohjpop5f7mg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlse3va6zonlim5niyl74b8jis-o0fwno4qethj1q7rm2r5xdba/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlse5htthgifmniezokiypnjjhanvkvlehsrk9esgcpoauqutiw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlse8ds15kxxdcrhfspcfrbvy6sbdhp0e4540zzmhhvzouewvka/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlse_mo9pzgdahzdgz0wctr7lm0cqm_zwos8ljc4cqgtvnqfmfq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlse_pppzkv1rppkqwcnttkpvx35meb94rruunhijhuua5svvcw/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseaopmohwe4llodr6rvz9ybhvfg0zoqnsxzvzuqwblxhy17ta/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseap64bhtbncjqllykpujyr2fa_s9yyfiylqbdnutvdu0kntw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsebpakzyvtprhygwe23jlsdieyoca0jtiyy-f68nqwofparww/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsebyedalhc7exqq5fljf8x1akbwz0h8l8ojbx5nx3go7bh3sa/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsebyedalhc7exqq5fljf8x1akbwz0h8l8ojbx5nx3go7bh3sa/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsecfgjnsq9_mee9dlkldhykyrjztlxrrisptiilyjqk5qndmq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsecilc_5ka58gxqjfrpwbfwmhykkdly-lwm9yubx1l1gwzgpg/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseck8-g3um70ihw-ajfait5whcec3qdowobizswz8_-et_jkq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsecl3bk58g9ucirun7tsjpfkkkeryur6xaryenk613tqzqfxg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsedam8qavfd7nwszgyriuofus5xlgrvwcojm_8jtzpiw9ud_q/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsedg-b07st85voaknpclg88z_zybaqffowcrxa-6eq1hemokg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseenhbbxtwamfmork3asua_pfejkhmxkqv8hlzwo-uznm3t1w/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsefkdadsbapfd3db9toxntif0evefzkwazu5xituuthp9mbxw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseghb19gxs04xdkab1cubu6qmclhh_rpb2fwa8nwutpbwnkba/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsegnx2irh_r_gtlspwo66pv4vkht2oobqmvjtvs4yqjj6vr7q/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseh8l6dbswsdhbte62h7cjnmea1voup-3y7qhvdepcv2euzma/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseht4cdltkad8967jjarcb5nafonbaw3dtpynth9mdk94hf-q/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsehwehncrhloyw72aebvvzvvzjrs6yz6qphpm1dvobyr8rnig/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseirld9oyigwxmec2bc-ax4yd-m-rhezlne00aminsjf0uteq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsejavlqdkikylynqlg6p7kyfu4qnlyy31opnfttucuhgmek4a/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsejzzt0w_l58kpcmcq1bseqi53i0retcnl0a1-uldxvnyz-ka/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsel8uq3oplbpuz97bjyv7s-6wdghzjiaiauioimsb9buzjfuw/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsemwyrvcln1ql8uxd0dsiswveuehikz5hwalfeni7jjfaefmg/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseo-icwia4ztexz9jczqsndvpn_la5_zoz8wkg2ldu_hm_4ew/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseo-icwia4ztexz9jczqsndvpn_la5_zoz8wkg2ldu_hm_4ew/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseoz9zpmm0c0fjksklv-p1hsrwsuybmj6bvbd_fkewzzcv_ea/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsepe4jevfm3mjc-vndxuq_9wjpc7afrjadkxvp8czawh27cqg/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseq5h3-5stw3bwnpoi6g-gfwcgej7q82incdm01dd1lf182iq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseqdx2wgybdxlhascsuopq1xqsmwrxjf4erl_cpmvtt96dq_g/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseqvqnxg0qnfc_qjompqm_bjbey-oivzpldd-sybsidx1syna/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlser-b6q--nvif2fj7nbn88dh8lj-s2yfbgjyuygwsacbhm6lw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlserwgqm-czpabole0qw-jg4bhicctqdjm3ex3v4vzifj5wldw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsesjc_ajwpmpcjuq95rukkgekj5y-knud2oyrj4ncetbm26yq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseszgantjzuxgteg0dsiizzmadcwjbjqcsri5nidod2rd2_lg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlset42bzecl3yrdnnffv6f7kecxpd1sy4rbh3h3govwg1k1z1w/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseumxp-wga1x873upqxmi_hx8nbbllh12zzmxia1xuqp2mgbq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsevpkt1byhl-oqjptw8wbecnm7-iqnax-mz8zd-mxp0fol3jg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsewr7-ksdpydhc1tv8tkcxrlad8zrf3q_uqt-rj9a_fmmzxya/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsewr7-ksdpydhc1tv8tkcxrlad8zrf3q_uqt-rj9a_fmmzxya/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsezbbqgms0nnvgk6aq0xz8sa19zyd8w87c8js99mpi3go1mqg/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsezxizhvg-i28_n8fyddanndnufw9veep4kk934yekxvxdmdw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsf-exsf9vm0rleksdp46wa2dfca3dhphayf4tl4rktjvmgguw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsf0-sqpytlsyi6uz7javookkcvby-sd4j8bc58zujl773d8qq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsf0appdcwb17-g15hxqlvwdz2cngcp90uuisclz55s2volujg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsf32hx6ujsi_gqji38udpamxxxnhyrx8qhmqcqnteinj_0cmg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsf36z5diim8ke7cwmm_uobqacgk-r3w_uslnwnn60nzwqi3fg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsf37osr6zds7tctpiqseyyoqpqnzaeyv704aye3atqnyhd4-a/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsf3wmsem7zluqpxpuwmk9qxvc5uvpl1qkhc3grlydk1ulezua/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsf7rktag6kzmtxateu6hu9atx0meohtzokrqkuvn62ojflqba/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfacaqo8c7hsu7mr6zkbsfulv8m710ke2qna_7tyusomgmtjw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfacaqo8c7hsu7mr6zkbsfulv8m710ke2qna_7tyusomgmtjw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfaekglhjlubx-j0s40wtk-dntowamok2u3dl24wdxhni6cuw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfdy4lqz9cxxc2z-9qldm8asxoikrw5w_jb9d0iciiyy_bpbq/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfe2ymhbjhlp2njbhcnyypkh2q_svr-hjv6jakyhkrcvnrfhw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfeoy_w3jwkkz8psgsw4nrja9tmg2lx0x0nvtmv38k0hjzzmq/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfesajj9-epeg0p0pdzfaf3xooefbwmwsn2jne-6doh86mocg/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfetregzccisehncfk6344jq5ab3iq6ft0a6k_v156sh5j24g/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfgejlprqaiajfduzoh8gejctdxdv-kyn38ztkb3fu6poxwzw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfgvr248yh1nbpu7vxfge6ez6e6vr66ia2m649og4_a87g6vw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfhrcintrbwx2of6w4vp1xd4fldir-qeghinej4jhsw4qzhjg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfjchag9rs_yczr5hheyuc70ukrtaonxwdhxso7_qhcpp04lq/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfjlibrqxxpw2arqzpzumujjray3jpd_mzn_kltz7jrbc93dq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfjpx-sxpejnp_q2fmfu0jy8oqoesrx9wbrqplcychw9luupa/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfjsgjhbjke-mlmni8cfg1tacz-hdpvmy5j2br9upjr1f7nda/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfjsgjhbjke-mlmni8cfg1tacz-hdpvmy5j2br9upjr1f7nda/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfk9hpkld9-qwaxs8b0cpslaw2-oomu6bcwpxkmp-fo8kr3ew/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfkl2vgsks6ni0mb3-noocjqf7auguvh9lavsnwjjy2c0mgzg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfksirdejkit-tdeiwrnkf00ygsqdsqth0hmwydiqdik10tna/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfmppmwkaythtoskrsm7wewzrcamfxbeyuc6f1ewjjmzisfwq/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfnjyzbmw-pd1byw4b4opoksx2cealounsnhg5fjc3fk1qocq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfnlsbejsiacubkj2geltmn7slefoweeczuagp3jfmfkijg4a/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfp1eukgsktriyraz2csynqwfwtv6ehlnbszu69dbxz9lirtq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfp1eukgsktriyraz2csynqwfwtv6ehlnbszu69dbxz9lirtq/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfqf7_zc-bsb7ej4d_rikrhb3bi-o15o1l1lsa-dw0nr-pztg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfqjyamn38kyfu1gixlitpfnnivmi4dcrwllbchwywxcnmcba/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfrhtzc1pcighculgyjg6juret215diaac89flqhhwg0wx9aw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfrw9nsla2lpenbntfmz3q_bu-6vayjudjntqikzcei2rl3ya/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfrzt6zpkhgtvzqutkypqtjffxaucn3evqpf6ytbqug3t41yw/viewform?usp=pp_urlorganization"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfsia_g4fb5yg_cu8fjuxcndbgqz1setzfedm0cw0eaonb57g/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsftriyys-rvphnbmh6v6lyimxjy3rpog8xvtb3v1agqhawiva/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfurofbzbtgxzdlg7v1q6lzyf6rqi8chpmiuzmmiqmxqhzb8g/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfwdsuczwrih_wnciwh_qjpg1v5p-qk8zyjjoccpbhmyeygrq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfyg4g3xanl17-4i833ep0joctptyxfsylqd3m2wujpwu1uiw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfzhyjvw1nn6bvqhbwmd3rcrm6gukuzir5u9tmsszmcrr8nyw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vq5dr7ajdkfwicg5n2lbhbfo85bwvgageeqmuvllkwg5i2iuhekmsvmwotev1nnzoy8xasnxerngqew/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vq7oplr_-m2wcmmli5bewiwc-vkkblykry1ejy1vfvkm6c-yanjplkligavkr2dt8vkw6dmpyzkp_ki/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqfy0klc7lmimfug7xrvape2jdz8153ptionyg7ht7va1ggm5loptsqunpgtiwn36i9y8ggrat6f7ka/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqljiqoxuypxg7a8r5x7frbq4cqcvnb77n155fzyxweegqibwjyjnpghjky3howsxyb0pe3g2wm_xpm/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqo0xukh2wuts-r_jah5nfa3jsnxxdkgvfcafnigv47ptitu24xoqtt_fhtwbm1p6wpz5ajydo3ho9-/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqopq9v2asclxkhw1tgkr3v1no0smckg8as4x6t4cyhuszvfjkaosxhp2phofsyb8ag0f-anei4kzqb/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqqcbi03ke8ybh6i0nyvaecikxaa6gdgzvgwdaygprivb_-gkvuvkvqb6hqfld9vovgdewxfkt6n1z-/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqx_zel_kuemn6sejjmr951m_x6bzzai7iqp25hfj909xoffbtw822kfnfdpl4uarmqcjov-ztc9m0l/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqywoq-kea3q3xkdnwfqqdxg368izvbbqutcjaxpy3t8duksihqmnqm70qvpl0oox5l-ijx6srgpgrz/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vr1mdvfskxsvwpevn0kbbzdj03tkd-qianser_mo-xjpu0pllzd34jz_eodizwbjztx0qsbqtch6oyl/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vr47cjjl6r4iffpd0yquj85wazh1jdtp6xpiofpjgzwu18olbjgh1cyqtfcolgtpryqmk2irslyi-rp/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrgv40o-9hv-h-te58y7dluzlgkiq2lgps9rphybq5nrrnwau-nlsnedjuazhprry10otfrh3_iq1tp/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vriyg_oiukpuguzpg2epbnyy4qjmk1v3maunksjuumfujoeerubxylo9_hltssk-qv7jsrfqfppdcgn/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrl1ylbscadiuntrkeq5xe_bz5zwgfjgao5atkkbeidhn_aqqyspym3hagxsqckazae7pwdwtgkfkvg/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrndlzd4qdrc7kjcsjuzzmrrr2jdhcja_8bqfaromkv4gc0xzecwkk64xdd0cqcypwk3_s_2plp8wtv/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrp2k-b45tcwcadgwzkulyaqrs1f9vfjs3y19o6fs_7p34ymzwuascr7lkuijhc83-o6fmsbbvehcf2/pub#slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrp2k-b45tcwcadgwzkulyaqrs1f9vfjs3y19o6fs_7p34ymzwuascr7lkuijhc83-o6fmsbbvehcf2/pub?start=false&amp\;loop=false&amp\;delayms=3000&amp\;slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrpahi2ri6ovz6eun9nmdyvxyen0na9v3_qjmcq-kwctc4lqjkedcbeyf4doyfx5urafpn8mu6hcrnj/pub?start=false"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrpahi2ri6ovz6eun9nmdyvxyen0na9v3_qjmcq-kwctc4lqjkedcbeyf4doyfx5urafpn8mu6hcrnj/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrrbkktbsjl0p2tdhjzjo2uawkvwbwipzqv2sgbcl7xpkns2l-hixlz_bwi0cstwntvcxq1a5r1lj4x/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrriatvgvtaoki3lje5es155asdvvgmqqjoosenskwwiutrtwubnfwgosjeuupxd5oda3gx6hbdaslk/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrv_qr8skf1llw-syahuvggfll1kvabdlhycyoyznbbf7iy2wvyjdxlynzbnimurs-rskipffjtklen/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrxxwdr6rx90gjqaynsfyoxo6zyqem0t5dkhvlps37wzw_yvtv1l-9a46qzs57vfulfph8uqh32fbvb/pub?%20start=false&amp\;loop=false&amp\;delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vs4t3osol5-a2tlqhpxcbnoykx-v0xpvbkex3ikocawxpr1jez_fqk0zq8ylq7w8_4du3b3z57qhj9r/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vs9iynmnt1qmlzrx07ug9wjcpumi8oop9omycxzs32_crcuz7usvufh4mzinngrsspgcofr-qq3fxot/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vsfs_pk4-zigqm1bnegx_9gawv7ys2cx90o0o77ppfeimlqbtuy7wv14npitdzydmp9gnfrcjiufcyu/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vsgw9oh1ixw4dhkvxkwxlwsu7de-mla1kkntrqmjmqiy0zicd42e_8eakt3kiywvfk0vrfexpkcjlmb/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vskgwhr2flv0fouv_mac13jdyp5a-drx8tnnnd4soc852jjodbgozj44z7_9v5_0xlktsc10xy93zgm/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vslpj7pk4-axbccjqtpblesxanwetmsmefuchs2sloxncmvllwzftu83w_w_uia1mjemn717hwpcfnq/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vspnbijel3trkgiucqlxf7ozncbv8afgi8spwy1we3rmyp_degyrb8lt2euqyscu25c3ow_qsaa4qqd/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vsrlb5wlmujw62qr1paqhiyiso0jfaxxzzlpaxtg6fgxhbg1o-q8w_fxbx628pud1ljjcxuwyrav0xb/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vssxayagcehnojap_9vi4vkx2fwqtkzpgwviy2j2efosj2xfmvqmsyv1avj3eclx5wb22joceezc8t0/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vstfqvabl0hbhkiycydogunjhmqqyeh-achsm8zlhzfvqv_d7ez5x4bgpphh-es6xilbwod1niq1hkz/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vstqki4nnnyrhsn5l0tj0ec7y31bzuyy4tndmtidtdxtpbnwjjrb1nj5rjx_04hmctvvf5iu4yxhjx8/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vsx8ahrvwaowtfdbywictcemrz6z1wlqenjtp97v184yas9irqjz2-axi0yov-zb9yo2o5rwe4c50hi/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vsyjh3oqjp_mkyqdaub6tdi-r0ern7crtrrkktdqq6uzvearmeidpgrwvued9lf7jirwkvoi8s63qn2/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vszmxwf77cx9jec22hwonfd-l1fnnca3x407pvkw3_aanghjmyvustququfenxznzckxgaszizaop76/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vtlsctrmytwlfbm8jahnsimsxwdjdk7ndptazmfi8y9togp2o8uozykkul9qp3xxeyhbco4zoeuiwbg/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vtq-t3xjc_nf74w2uz3lqt-hbg-39f7xizkvxay1ngcpmau9murjkla2ye5ahoqobamifucwmttssw5/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vtwkjwy3_-kl8f5w9p6a1topb1ob0r15tijqhclejlxmwtsicqxiktafoxdxkehh4tlvfye7c6xs3og/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c/ejxnt9lowzaq_jr6jcpxnoqhdxrkjuoliccol2ptr9v0ciljcotrcsuqskvv7mh2zuejdfu-a4prxlbl22l1dknw5fpnfzcu_rjhgwekqtjlneqau5upway0l1src1eaiajqyijpdob7mlfpprymhxgltjvtj5fsk0bdrdgsmiw1fe4jlihthiuzz8wuponxscag6anwd2facqi2mxb9rjxp-fuq6lo_vdmee5sm4yg-pperbxtgorogbj6vnleuseckmmzebgavykymacmgfdpc6c9t4sdzvnawzi5vc13pd_olrcwfkvcbdq36frthtokmde1eo8hvk_l0bbkrx_uzcggtyv5d-tt-7stge9p_ojbyisrxjbqdwywur3djrtrunvxyt5s2e9d3y-2c06ufis_wugkpslplrcks_wyb8jdm"; http_uri; nocase; content:"docs.transactional.pandadoc.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200060947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/3a5r5a92ssx38jsi"; http_uri; nocase; content:"docsend.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/7kbaanzkgswcge6a"; http_uri; nocase; content:"docsend.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/jd4wxg8qzwd3b34e"; http_uri; nocase; content:"docsend.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/slashclick.php"; http_uri; nocase; content:"dogosoft.com.ar.ca9.toservers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mt/log/"; http_uri; nocase; content:"doinikdak.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"doufatin.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/19zpw90jgon3j5merxi1pauvkjdmx8nfq/edit"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1bcdyitw2vo5jp6yrbdmiy8cfrkcf4tby/view?usp=drive_web"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1c5o9_y8_octsepwyojfarn1k-kj4d9fe"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1fdgs5g6fqqkudcl2meym63ua3yu0o-tb/view?usp=drive_web"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1ginbnlpvt7kpfnog9a68fqmn7k3aivui"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1hdvx7j89h5l7yz39idgzhqji93jnkl_c/view"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1jixb69t_nw9tmkhvfrejkfzof3d-ijet/view"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1qf58h-1lunq1pubplwdhwd3uooj_vjxa/view"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1robiosanbh8doqa7yuiewn3akz4094ho/edit"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1sf-ka2tuqr3-ievafi4ok5hjd4fsqqg1/view?usp=sharing_eip_m&amp\;ts=6302a657"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1vcc1-wujbe-iacakickb5lk7pli9dhon/view?usp=sharing"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lulu-hypermarket-careers"; http_uri; nocase; content:"dubaivacancy.ae"; content:"Host"; http_header; classtype:attempted-recon; sid:200060965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/aruba.it/aruba.webmail/arubaredirecti.php"; http_uri; nocase; content:"duobabiji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?ref=agfuc2pvzxjnc0bnbxguzgu"; http_uri; nocase; content:"dyuvstyfawecteraw.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/owa/auth/logon.aspx?replacecurrent=1&amp\;url=https%3a%2f%2feast.exch082.serverdata.net%2fowa"; http_uri; nocase; content:"east.exch082.serverdata.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200060968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/marco_eeverywhere_com/_layouts/15/onedrive.aspx?id=/personal/marco_eeverywhere_com/documents/documents&amp\;originalpath=ahr0chm6ly9lzxzlcnl3agvyzs1tes5zagfyzxbvaw50lmnvbs86zjovcc9tyxjjby9fcwhvbeq1x3hltknorzbdmdvvmgjvvujoy1z3b25futjvejhtlwxqrg9svwvrp3j0aw1lpvduaunytfu4mlvn"; http_uri; nocase; content:"eeverywhere-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m&#61\;0"; http_uri; nocase; content:"eleoelswka.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?u=5tlkgeu&amp\;o=gqfpqzm&amp\;m=1&amp\;t=th_ppp11"; http_uri; nocase; content:"elite-ladies-here.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200060971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?url=https%3a%2f%2ftilbakebetalin.wpengine.com%2fsw%2flog%2f&data=04%7c01%7c%7c11af7bbcb8534b33863408d9e17cff46%7c84df9e7fe9f640afb435aaaaaaaaaaaa%7c1%7c0%7c637788749239190942%7cunknown%7ctwfpbgzsb3d8eyjwijoimc4wljawmdailcjqijoiv2lumziilcjbtii6ik1hawwilcjxvci6mn0%3d%7c3000&sdata=wyye%2fyjymouztvtdzw%2bfpfpyzj4nrvzhvloufqhq128%3d&reserved=0"; http_uri; nocase; content:"emea01.safelinks.protection.outlook.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"eneeeetsowww.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:x:/r/personal/nradonich_ersfilter_com/_layouts/15/wopiframe.aspx?guestaccesstoken=t6t%2fhn1dkbyhlyx%2beimbazufa43rrgz6%2faaaewnocdi%3d&docid=1_18168db23429e45f29fdf2e7be120efc4&wdformid=%7bb9970f62%2d44c3%2d4d09%2d9929%2d6e1eb652da57%7d&action=formsubmit"; http_uri; nocase; content:"ersfilter-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/nradonich_ersfilter_com/_layouts/15/wopiframe.aspx?guestaccesstoken=6ywmlbqi9%20sjfgzhadhvte2gyowjf83iqbjrjehik4s=&amp\;docid=1_135f7008dfbfa44e6b09dab0eb165b997&amp\;wdformid={e037f2d9-5daa-4916-ba03-eb11d0aa6dea}&amp\;action=formsubmit"; http_uri; nocase; content:"ersfilter-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/nradonich_ersfilter_com/_layouts/15/wopiframe.aspx?guestaccesstoken=6ywmlbqi9%2bsjfgzhadhvte2gyowjf83iqbjrjehik4s%3d&docid=1_135f7008dfbfa44e6b09dab0eb165b997&wdformid=%7be037f2d9%2d5daa%2d4916%2dba03%2deb11d0aa6dea%7d&action=formsubmit"; http_uri; nocase; content:"ersfilter-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v1/app/gbwa/image/transformer/4573be1d04074ebfab8fbb16f21a65de"; http_uri; nocase; content:"esa.www.wamodshost.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hxzqtupytrajanouyatyt"; http_uri; nocase; content:"espace.fanlink.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200060978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/17369aa91d5549c192b0f736d5822403:rr-frontpage/index.html"; http_uri; nocase; content:"eu2.contabostorage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/shard/s339/client/snv?noteguid=f48e12fd-48da-e57f-8e76-cdf6e4054e1d&amp\;notekey=02a9fa6bd051dc6b4581ee3b617b3f88&amp\;sn=https://www.evernote.com/shard/s339/sh/f48e12fd-48da-e57f-8e76-cdf6e4054e1d/02a9fa6bd051dc6b4581ee3b617b3f88&amp\;title=optus%20webmail"; http_uri; nocase; content:"evernote.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/shard/s446/client/snv?noteguid=4dc119ab-57d6-b8e0-4fcb-c11c0a637b94&notekey=9ddb3753cb700b0c86a78176be71f4f5&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs446%2fsh%2f4dc119ab-57d6-b8e0-4fcb-c11c0a637b94%2f9ddb3753cb700b0c86a78176be71f4f5&title=you%2bhave%2breceived%2ban%2binvoice."; http_uri; nocase; content:"evernote.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/shard/s446/sh/4dc119ab-57d6-b8e0-4fcb-c11c0a637b94/9ddb3753cb700b0c86a78176be71f4f5"; http_uri; nocase; content:"evernote.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/serviced/usps/verification/"; http_uri; nocase; content:"exam.mentorboy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/tim_hansen_excelelectrical_com/_layouts/15/onedrive.aspx?id=/personal/tim_hansen_excelelectrical_com/documents/open%20to%20view%20shared%20document%20in%20hitech%20sharepoint&amp\;originalpath=ahr0chm6ly9legnlbgvszwn0cmljywwwlw15lnnoyxjlcg9pbnquy29tlzpmoi9nl3blcnnvbmfsl3rpbv9oyw5zzw5fzxhjzwxlbgvjdhjpy2fsx2nvbs9fa2zoazdydndfaettvl9pwulkctdzmejlveeyr3awzwjnsdfkrgdjrfdfttznp3j0aw1lpunrvevzrwxcmlvn"; http_uri; nocase; content:"excelelectrical0-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/r?us_privacy=&amp\;a=p-w_ayumw3pzr2w&amp\;labels=_qc.clk,_click.adserver.rtb,_click.rand.60541&amp\;rtbip=192.184.70.137&amp\;rtbdata2=eaaaiencvf9odwdnzxrzx1e0mjfftwfuywdlzf9tzxj2awnlimofncj-jtiws_b-ohnodhrwczovl3d3dy5syxcuy29twihbt0llsefpmvdcvwi0vmdxvi1julfbztjdullinvfzuuitwjdutjfpdu3bfukaayfd3aqeoaebqahv4fyeugeawahq-aniadv5u4til9obfllxavhtz0fpaghnqs1sufktuvntqkhlaarzydroawsyaviznracclocbmc4ronaagliagdqas7hhvv4n_fmqqhgagdoagd4agckaxywlnb1yi0xmjyxotkyndq0odazodc1mamaqamasgmejmh7angd_dgd4gmpcc13x0fzdu13m1baujj36gmfcngfefryawu5mjeymfgdaiaeayoedxf1yw50y2fzdc1xyzhybajvuw&amp\;redirecturl3=https://www.cbtnuggets.com/?utm_source=quantcast&amp\;utm_medium=prospecting&amp\;utm_campaign=general_us&amp\;utm_term=testimonial&amp\;qc_campaign=cbt_nuggets_q421_managed_service&amp\;qc_adid=2078771"; http_uri; nocase; content:"exch.quantserve.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hksr"; http_uri; nocase; content:"fanlink.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200060986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/investorway"; http_uri; nocase; content:"feeds.feedburner.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/drttttt/adobe-3d6/"; http_uri; nocase; content:"fieldtripconcept.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/aspire-127b7.appspot.com/o/dnd.html?alt=media&amp\;token=58da9567-441f-4f7b-bf07-290e808e5d8d"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/aspire-127b7.appspot.com/o/dnd.html?alt=media&amp\;token=58da9567-441f-4f7b-bf07-290e808e5d8d#hughesmichaela06@gmail.com"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/cardilogist91983.appspot.com/o/index.html?alt=media&amp\;token=40dc7341-52e7-495f-8ba3-04f739b67ca0#@yorku.ca"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/dr-clin-c4f68.appspot.com/o/drweb.html?alt=media&amp\;token=09293ba9-0738-41ea-9cf3-67cb43af2b88&amp\;x=famacas-cfa0appspotappspotmacas-macas-vfwefsaxsppspotcfa0ps&amp\;prox=p2000isolation@aaa.kr"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/dr-clin-c4f68.appspot.com/o/drweb.html?alt=media&amp\;token=09293ba9-0738-41ea-9cf3-67cb43af2b88&amp\;x=famacas-cfa0appspotappspotmacas-macas-vfwefsaxsppspotcfa0ps&amp\;prox=yourname@yourcompany.com"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/gho2408gen.appspot.com/o/%5c%5cgho2408gen%2findex2gho_obs.html?alt=media&amp\;token=269e2a71-4a9c-42da-a207-2fc31ff7f812#mohammadahmed7760@gmail.com"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/nnnnzzmbcmmm.appspot.com/o/index.html?alt=media&amp\;token=ff8efd0e-8cdb-4767-998b-f421eee08f97"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/okorocha-9d683.appspot.com/o/indexxevol.html?alt=media&amp\;token=f9ee1486-b8df-4f55-8b9c-466fcdcf99a9#@yorku.ca"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/outlook-4c0f2.appspot.com/o/books%2fwebmail.htm?alt=media&amp\;token=216401d2-aba7-42f4-8fd5-9b672cade830#abuse@optusnet.com.au"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/outlook-4c0f2.appspot.com/o/books%2fwebmail.htm?alt=media&amp\;token=216401d2-aba7-42f4-8fd5-9b672cade830#tiekimas@tidlo.lt"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/pass-up-date-now.appspot.com/o/update-update-update%2findex.html?alt=media&amp\;token=d3144df5-bf15-4058-a0dc-9610b1a9193c#email=info@domain.tld"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200060999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/preserving019029.appspot.com/o/index.html?alt=media&amp\;token=caa885e7-5275-4bde-bc3d-a3eb2c95dfee#r@yorku.ca"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/rei-rezuio-rexire-565.appspot.com/o/%40%40%40indexv-vb-vau-ry-8%252fbv-yu-er-8f%25252525%2525252f%25252525%2525252f%25252525%2525252f%25252525%2525252f%25252525%20-%20copy.html?alt=media&amp\;token=da92acdd-870d-4049-b9ac-f0d373777f06#info@legalshield.com"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/rned-a824v.appspot.com/o/gen%252findex2oli.html?alt=media&amp\;token=828c2259-c86f-442e-91a0-8d43a1fe7d8b#abuse@optusnet.com.au"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/rtzmthtcnncttoaccs.appspot.com/o/index.html?alt=media&amp\;token=8d757dc9-62a7-4c67-b241-997916e540f2"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/scnzmaccsscnncttw.appspot.com/o/index.html?alt=media&amp\;token=fe08a148-55d4-4bb8-8d3a-53479440818f"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/tei-neriou-reuix-678.appspot.com/o/%40%40%40indexv-vb-veu-ry-8%25433%2569.html?alt=media&amp\;token=6b0a9c43-8711-491b-9f40-50ad280ffb32#ggradnigo@prepaidlegal.com"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/update-d2e45.appspot.com/o/update%2fupdate%2findex.html?alt=media&amp\;token=ca2d4bde-8124-4812-9c7a-1ff88eb47549#@yorku.ca"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:o:/g/personal/lewis_webb_firstfederation_org_uk/eid78dus_cfjrrv2swyzp-ob1udpvku1sjneglgmz_0zwa?e=dcj1hk"; http_uri; nocase; content:"firstfederation-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/imagex/ahr0cdovl2fscghhlw1hcmtldgluzy5vbmxpbmuvb3b0dxmvymlsbc8=v"; http_uri; nocase; content:"flackbox.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dike"; http_uri; nocase; content:"flow.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200061009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/13c1ofsbi?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/13wrz1ibd?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/1s6hcovwa?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/1s6jiqmub?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/1sbjwytzo?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/1scqelfiy?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/1shwmjpay?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/3ztlklevg?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/jsoo0zbqr?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/btalertnotify"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/btupdatepage"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/dixatt"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/hip"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/j50"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/s21"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/xpsatt"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/221027503251138"; http_uri; nocase; content:"form.jotform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/221186654354155"; http_uri; nocase; content:"form.jotform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/221295519236559"; http_uri; nocase; content:"form.jotform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/222214228957053"; http_uri; nocase; content:"form.jotform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/222425861915155"; http_uri; nocase; content:"form.jotform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/222592794928573"; http_uri; nocase; content:"form.jotform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/222624132806045"; http_uri; nocase; content:"form.jotform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1mqqu8exzgpptqpl8"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/383dh17bsrkkq3tu5"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5wjuv4glrx78xun4a"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8epxhwdapiab7mfw7"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8oszgml1rvofdvtv7"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8vb7wfyzcoeb6vvj8"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9bwawhpz5vi7ilpe6"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/akohiguxjs9wlpu28?sllqm"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b7lqaal42juffiw1a"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bfz2l7i3wvrp5heb9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cfqg5uz57ehywkhp7"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cqzwfmqvrsnm7wrq9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ejefrdpmyoad4gm58"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eozlrnnf7jh84xdp8"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fc47eidpg6e64gkt5"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fvaq9zhxfhgqbusw9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fzlons3fgnjdqdd19?omgbfzrazhlppbtx"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/goerpntl5tfeumdz6"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/iai7pzm4pxyb145i9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jnkkauxwwbfhtuqz9?hkgotygikyoujp"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jzxtb9auexgjcewfa"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kadtekzswcevrtz38"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kehch96avaku7oey7?akowgmooutpwa"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mpkhrpn3jc8pqv7j6"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mwctig62j4y5mgm3a"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nokye42b5qkubgnt9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/puadbxscibgw5ma79?xfccuwmmhgwrwztd"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qxxe9xuu3h1lgpyc9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rwpcmhm8vtfa7f4m8"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sj21ehdebhkcpvfv6"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/smufgmyhduckbq6ka?fjxhgyroek"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uqzzznxv4cfhu3yr9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v5xtnywt5s6zvpp27"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/w6uh9p66tdq6l1m66"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/x3aasffazsrl8pcr9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xxjqmu6luzkpnalg6"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200061068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/5ed641e5cabd481304386f35b9120276/"; http_uri; nocase; content:"forms.monday.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/5ed641e5cabd481304386f35b9120276?r=use1"; http_uri; nocase; content:"forms.monday.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/deef05667ad4b4a16abdf4cb6da54137"; http_uri; nocase; content:"forms.monday.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pages/responsepage.aspx?id=95vlqxxdseiozn16dgibdsdprn5ritrknkwe8o-kcqduntbduvdwsutpqzzcmk85mfdrsjk1u0pats4u"; http_uri; nocase; content:"forms.office.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaan__gdpmarun1y5qlrqnjbkuvlhuvgyu0q1q1axszg2wi4u"; http_uri; nocase; content:"forms.office.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__tdasqlurfrqmjzxneyxn0g3vexutfvzq0mztu9fms4u"; http_uri; nocase; content:"forms.office.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__thg5xvuodnbwtvytzhwwdnctknvovo4tldctexmvi4u"; http_uri; nocase; content:"forms.office.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pages/responsepage.aspx?id=jrbxvx3x9keewcq72hm6fnkqekonandcsjd9av060h5urepumvvgmks2te41rfewmlletulvufnuqy4u"; http_uri; nocase; content:"forms.office.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pages/responsepage.aspx?id=ohdyclicseeuggrjwocnyc_obsknc9faprsbco6mlnhurtnevvdzuzzewddiq0xoskixulbontdsrs4u"; http_uri; nocase; content:"forms.office.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/r/ne89gvwrye"; http_uri; nocase; content:"forms.office.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/247michaelbryan/form/signinyourbtaccountcorrectly1"; http_uri; nocase; content:"forms.zoho.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pattles066/form/signinyourbtaccountcorrectly"; http_uri; nocase; content:"forms.zoho.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/traskray168/form/signinyourbtaccountcorrectly1"; http_uri; nocase; content:"forms.zoho.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/armandb622/form/signinyourbtaccountcorrectly"; http_uri; nocase; content:"forms.zoho.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200061082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mucmddc993/form/signinyourbtaccountcorrectly"; http_uri; nocase; content:"forms.zoho.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200061083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/folder9/adobe-3d6/"; http_uri; nocase; content:"freefantasybook.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/help.verify.html"; http_uri; nocase; content:"fvhyrsxzact.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200061085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dbccb42?q=chkvp2k9mtezotmwjmxynwfo"; http_uri; nocase; content:"game-time.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2022/01/daily-rm8888-shopee-1_23.html?m=1"; http_uri; nocase; content:"gift-1212.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/o/free/?elqcampaignid=9288/"; http_uri; nocase; content:"go.docusign.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01fez46yyrvh6f0bbehn8h419h&amp\;persistence=1&amp\;checksum=069f46345ac935567ad562a3d64a332066064c97f8feae803d555f9cc820c561"; http_uri; nocase; content:"go.skimresources.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01fezncfbjbj86yneatjn0qvt4&amp\;persistence=1&amp\;checksum=8142350e161acc6cb246be1d05d596973a1d3ac50af1f3594ee9ea462c87a4ef"; http_uri; nocase; content:"go.skimresources.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01ff06m6n2q43m6zcaqrh8xpm2&amp\;persistence=1&amp\;checksum=26e140f8abae23dd0c8dd547390a4deb9fc54b1acf3539d8aa44fb19e04902ef"; http_uri; nocase; content:"go.skimresources.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01ff0qxy635yfpkrdaxav47j5k&amp\;persistence=1&amp\;checksum=cb2e0f7328d6ffea0e15a24046095a0bb98d27d4488e822bea4b181763f2eb0b"; http_uri; nocase; content:"go.skimresources.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/aksf"; http_uri; nocase; content:"goo.su"; content:"Host"; http_header; classtype:attempted-recon; sid:200061093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https://spk-kunden-manager.com/rcjju7exxu#1lwkr92k20x&sa=d&sntz=1&usg=aovvaw1sjseir4b0q4l8sbg3z3us"; http_uri; nocase; content:"google.ch"; content:"Host"; http_header; classtype:attempted-recon; sid:200061094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?hl=en&amp\;q=https://quarantine29042022app-1311615844.cos.ap-chengdu.myqcloud.com/aaqkagm3ztm2odcyltawzgmtndk3ns05zjuxltixzmyyyznkntexmgaqadpitonhie1hjl70qeb7vdi-quarantine02719message283/quarantine.html%23pimo@apms-ltd.com&amp\;source=gmail&amp\;ust=1654842023923000&amp\;usg=aovvaw3tlbzf2sxh2-mtjs7iurao"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?mo=78986685794&q=https://c1r.at/h49xmdcp&zp=5095739289&kf=59242331&sa=d&usg=afqjcnf_3jyqkupfmf1gle_0jmhtak3s0w"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=http%3a%2f%2fbit.do%2ffsgjq&amp\;sa=d&amp\;sntz=1&amp\;usg=afqjcngvqc30z-4hiaizv03gpwblwu3vnw"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=http%3a%2f%2fcanarytokens.com%2farticles%2fterms%2fimages%2f6273376tgy8lrrnek9ai08a01%2fredirect.html&amp\;sa=d&amp\;sntz=1&amp\;usg=aovvaw20yd4y6h3k2ostqzlu8pmd"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=http://nouvelles-hybrides.fr/wp-admin/general/hhhheng/hhhheng/hhhhh.php?email%3d%5b%5b-email-%5d%5d&amp\;source=gmail&amp\;ust=1648980902684000&amp\;usg=aovvaw3lj6xdrkr7te65my0ifv8q"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https%3a%2f%2f094847.webflow.io&amp\;sa=d&amp\;sntz=1&amp\;usg=aovvaw2kpvsektuckv0n_xmzf-pi"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https%3a%2f%2f51.fi%2fai6n&amp\;sa=d&amp\;sntz=1&amp\;usg=aovvaw3ztrphk75w64vrj-rkdbza"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https%3a%2f%2fpo9cz.weebly.com&amp\;sa=d&amp\;sntz=1&amp\;usg=afqjcnec0vbdyqyotdsbz7gijk588avcwg"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https%3a%2f%2ftestwordpress.top%2fwp-content%2facaynumpang.html&sa=d&sntz=1&usg=afqjcneq22nczpte3zh2zdvetbj9kx5z1g"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https%3a%2f%2fvip.91234567.cn%2fwp-includes%2firsapi1.html&sa=d&sntz=1&usg=afqjcnfo-ujbo-tnv5d6why8olvgunjxjq"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https%3a%2f%2fvk.cc%2fcbjxkb&sa=d&509=848&usg=afqjcnec4gkgoe88ifnjjrnagnlez6uneq"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https://393512dfd8544c98be9a40f2f67df8bd.svc.dynamics.com/t/r/a7uua5shyiplufx4zj7f6u2clgtguiagoxngfoio4am?clientid%3d70000%23%5bemail%5d%2b00-70000&amp\;source=gmail&amp\;ust=1636719774661000&amp\;usg=aovvaw2fsk8htfwhsfqapvbu674n"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https://c1r.at/fzleuule&ry=9080899&sa=d&ha=9992286639&usg=afqjcngde0oxaxjtp-semb24qndyxqpfeg&jj=95316071"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https://c1r.at/n62bfdcp&od=3896761062&sa=d&usg=afqjcnhmj6a5ejlmnfnws314axi9thcopa&qw=69345649672&rh=90290680"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https://shiny-field-9548.on.fleek.co/?node-hash%3dqmzx2h92h51hopkxgfoaxkbjsymzqxuyxyfkw74s3qgcf1%26ci%3droy.libarious@alsaad.com.sa&amp\;source=gmail&amp\;ust=1660041395315000&amp\;usg=aovvaw1qsi_dkkhcsntjrcbe6ewe"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https://spk-kunden-manager.com/rcjju7exxu#sx0z5vskhyx&sa=d&sntz=1&usg=aovvaw3wt2smooknv0nq-tlwykit"; http_uri; nocase; content:"google.vg"; content:"Host"; http_header; classtype:attempted-recon; sid:200061110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/i?u=a894ec7f.46t33454t4.pages.dev?user=masoli@legalshieldassociate.com"; http_uri; nocase; content:"googleweblight.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/i?u=b4e921f0.sso-mailsrvr-4344e5teed.pages.dev?user=abuse@gmail.com"; http_uri; nocase; content:"googleweblight.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/i?u=https://webmailn0s9344.myssomailsecure-srvr3.ws24.biz/index.html?submit=redacted@redacted.tld"; http_uri; nocase; content:"googleweblight.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/auth-here/"; http_uri; nocase; content:"gophomet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:x:/r/personal/tspencer_gormanusa_com/_layouts/15/wopiframe.aspx?guestaccesstoken=wgfwcmmssvdsofa7ljviwaj85tleclug2xbvoqwlmp0%3d&amp\;docid=1_12424441d8c29412bb868684e5cb74e47&amp\;wdformid=%7b992e319a%2dbe72%2d460b%2db6b4%2d2d3fcf789fc5%7d&amp\;action=formsubmit"; http_uri; nocase; content:"gormanusa-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/#redacted@abuse.ionos.com"; http_uri; nocase; content:"gpuljrckogoygmrc-dot-ani0-elpx-sk-eftx.ue.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2021/12/window.html"; http_uri; nocase; content:"hangovertest1.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/data/optusnet/files/index.php"; http_uri; nocase; content:"hardcrossfit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jp"; http_uri; nocase; content:"healingmusicofthesouthwest.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/secure/id/index.php"; http_uri; nocase; content:"higherselfdevelopment.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vpib5oq/"; http_uri; nocase; content:"hotm.art"; content:"Host"; http_header; classtype:attempted-recon; sid:200061121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wncom1b"; http_uri; nocase; content:"hotm.art"; content:"Host"; http_header; classtype:attempted-recon; sid:200061122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://dplux.com.ng/cgi-bin/"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200061123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://free-url-shortener.rb.gy/"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200061124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://ib.adnxs.com/seg?redir=https://secure.adnxs.com/seg?redir=http://owl.li/pphv30sb9tt"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200061125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://m0-online-infov4.duckdns.org/auth.php"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200061126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://trimurl.co/0wsx7z"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200061127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://www.aquarelle.es/tienda/ramos-de-rosas/"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200061128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://ykm.de/f4b990c239777330"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200061129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://yuzurihah.duckdns.org/9e9q1tj?userid=yl3czfei"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200061130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/https://aratera.com/wp-admin/"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200061131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/https://bestanimakers.com/fwdirs?irs-gov.data=sa01331mnq"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200061132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/https://performancelocal.com/wp-admin/"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200061133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"//ykm.de/f4b990c239777330"; http_uri; nocase; content:"href.li?https:"; content:"Host"; http_header; classtype:attempted-recon; sid:200061134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/#cnbpzxjjzubyahjpbnrlcm5hdglvbmfslmnvbq=="; http_uri; nocase; content:"hygocart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ebuse/servic"; http_uri; nocase; content:"i-m.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200061136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/webaccountupdate/stockholmsuniversitet/"; http_uri; nocase; content:"i-m.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200061137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/prostars/index.html"; http_uri; nocase; content:"idola.net.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200061138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mdkea5ckpozm/click-here-to-start"; http_uri; nocase; content:"ifyufyujk.quip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/4t6u/bt"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/4t6u/e"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/btbroadband/bt_broadband"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/btin/bt"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/fgjjm/1-xp"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/iuhj/kay"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/kennymoore12/btinternet"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/kfouo/btcommmms"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/lasodi2/attworld"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/lobby02/attusers"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/lofty2/mobileatt"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/microvalid/bt_mail"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/microvalid/btcomms"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/microvalid/btcommuni"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/msw0rd/att_word"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/msw0rd/attsusers"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/viewer/vbid-31138d48-omsttuer"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/viewer/vbid-fa0f29d5-fpsjmms8"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/css/api-ganz.php?key"; http_uri; nocase; content:"imaninet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/viewer/vbid-fa0f29d5-fpsjmms8"; http_uri; nocase; content:"imcreator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/emailupdatee/owaweb"; http_uri; nocase; content:"imxprs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/outlookwebaccessupgrade/outlookwebaccessupgrade"; http_uri; nocase; content:"imxprs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/webmaiil/accounttportal"; http_uri; nocase; content:"imxprs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/238eae4e-7809-488b-8a61-99e7f7b20111"; http_uri; nocase; content:"indd.adobe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/js/net/"; http_uri; nocase; content:"injazrest.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/index/user/login.html"; http_uri; nocase; content:"inpusdt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/j1cxrrh7-"; http_uri; nocase; content:"internetservicetech.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/j1cxrrh7-%20a99jcpazg1u1lchzsks0nyx0reukftnqsc"; http_uri; nocase; content:"internetservicetech.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9g9h"; http_uri; nocase; content:"inx.lv"; content:"Host"; http_header; classtype:attempted-recon; sid:200061168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9git"; http_uri; nocase; content:"inx.lv"; content:"Host"; http_header; classtype:attempted-recon; sid:200061169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9gkk"; http_uri; nocase; content:"inx.lv"; content:"Host"; http_header; classtype:attempted-recon; sid:200061170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeia6ano5rwklrhhxag3jyadrix7slh4v4wwo2g3xwsdowd4rx4eulm"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeiacr6ny4gqer2nnmp4d2qujxpfvtjcqtqrloqqlubkpufkc3vo7ly"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeiagbszmg7i45qtecbq22b2qssbfloccz2w5jlblcdrpd6pe4grnom"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeiblg2hkuyf24md6qubrcu2omofpdgb73aoukpafsqkpflxjby3fum"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeic4olp55f7k6djfpg7atntw4x4ibo2t3cxbtxpvf5ptvgdzrjmu5a/"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeickox6fgjgaccllg65ly7svr4dr6chbvzjqn676cu7bu5lpoa244q"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeicqyn6jliwpp5zfl4ybbuvx67azwr65vg4ssd3teg7rfozfusoipi#redacted@ionos.com"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeiebgng7rudsc7pumuk3mczfc3dmh75chcafw7untvjagi22n6thbi"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeierep5ctolfq3qygta76w2wwweo2l3rvt42ydnyk7bmevzzuneumq"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeiew3kqovi4w24krkzgf55ov7kpzz4cr6jwmvabinvgnqh3ipkrhje"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeifatiflhlbavi2sdhdupez3scj2sx2nagussxzjbtlqtdudwexriq"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeifqgnotjf7agbp37qtcqtkv7vk24bxcr3p6wyyfqru577lyt54cty"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeig6ejnuun2ejcz4uuztn3r3wahbfb57qbyeuifoflixoq3se3e43m"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeiggw63lcdef5tsis22jkixcza42ong35tmbrxjgrvkuzpmy7qn6iq"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeigi326uhs3mlcolo65tt2xjs35td36ljazsv6hazjmqauosarcimu"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeihm566ce2hlr65n7bdmgdh3wfj7ikw2vvnwv3gehbtyqq22xwtrqy"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmap7f2zzcedqqbhxtm1ymah3jakkpdqyhbdfoteu938sf/#webmaster@cuni.cz"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmbtirqa8ezbj2rhbjd7bg8ncingx4hjcurnmul6dapx5a/#"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmcuhgyqoswz2utjswxwclrielscuyypppthpj2pytr8rl/"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmd2qkznn6vjmwyerzuugvpnzex4xngdhuxe9zxv69xweb/?"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmdh8cdcnwpfj66wzfsi8bmobabvehreffj3uet1v4obzy/indexchu4eg.html#redacted@ionos.com"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmdumuhtw4u7kj2p9835yy5xh4f1lu9q9g4zgyoeamy3ji/index0000.html#vanicekp@utia.cas.cz"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmejokdqrqrzhbmrxfz6ow3zochj97duyzeb597rvzbkf5/#user@domain.tld"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmejokdqrqrzhbmrxfz6ow3zochj97duyzeb597rvzbkf5/#webmaster@cuni.cz"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeibgo4qe2gdekkxziqbslwf47ose3wbilecxlixywumiaulzhtbj5u"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeiccc3ixl5eq7nkezfxw2b2ijzexpgcqf3dwemmxbbxk4tha4bmogu/daoff.html"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeicdp6mowbnreb6ytzovv76unrhrfi5yxs2eqlft4ysb34l67rkplm"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmaq7zvsrccbkm7xqvmz2amr7hu5yqbwvkbb9q8ygayhsx?filename=home.html&email=mgomeze@mapfre.com"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmbuzpoyfqdvxykecupehhes4r5cuf8wws8mgb3bvt7qs4"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmbyxvvnbhmgcieeitavydrhpcsxgxbru5pejqfkr7p3bj"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmdfsyh8gvfy5cpborbhm7usewm2arsqmynrgzgjfdfauu"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmdwwozfj9izkpqarjxkn2ny3iswfrtfsssxjqpscdgpqf"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmebhkt36w3jfrll2k4jevvpvsniym5nessgtvjuaqjxje?key=bf38df4466e9cb6870142585341d7c28c4be5cba&url_01=https://asserta-honeyedly-toom.s3.us-west-004.backblazeb2.com/index.html&url_02=https://climacium-opuntiales-retar.s3.eu-central-003.backblazeb2.com/index.html&url_03=https://equalled-hylodes-penmanship.s3.eu-central-003.backblazeb2.com/index.html&url_04=https://keepsaky-samiri-subcyanide.s3.eu-central-003.backblazeb2.com/index.html&url_05=https://eccyesis-euge-splatterfaced.s3.eu-central-003.backblazeb2.com/index.html&redirect=https://www.amazon.com"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmeqavcdcx67csyhvunlh6z9dbewdlgrqm6nltvjwyvlak"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmp2xqjvakuar6mep3ekrgcptzvmbrzchtyyl8jmbv758d"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmpgzdpwe4lt4143zybsw1p1qyru6wccyv7izzxuq2gyvr?filename=reconnect.html#a@b.com"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmpsubbbqzdwx3ftcwnaj4f34y1nynqtfjeq3jsejsuxtw"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmpsubbbqzdwx3ftcwnaj4f34y1nynqtfjeq3jsejsuxtw?filename=index.html/#redacted@ionos.com"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmqoiv2cpzikaqyvv5wq4jhtg4g6qgp7rcfpu8smu5avjj/#example@example.com"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmrgnejxv3o3jvwb2rsrh963nrvpoo9vx89nq7wjprtdmq"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmrhpfgn74c9yxxssli9vksdmradxtr7tmvfmfn88dyzan?filename=index.html/"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmrnherc4eg3rbudu3gxnw9ftxhermswijyqxckyqv9nnh/"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmvzommzxpatyuyj9vinhyqvhedsq2i3dqcxhygenfahhn"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmw5snp4fgklnax4t8mncaxvrhspsu6hatu1jwt8ueq8v9?filename=index.html#redacted@ionos.com"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmwshtrcmnveckbcjbgecitjhybhpwb1n2u4sgdy6udm8u"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmxqbc54ga2huodnlbdw3wbbnhjwng5nt5iki5neenq2hk"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmxvowxqb9kkbuau5zzebzfqmlyapkftqz1axupkpvtu6g"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmywh6vyxm5ramyf7yttnkms99jtgc9h4wv645bzcoohq1#gabriel@zilch.nl"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmbgkpys1tccxhyt2ie4ig583rnqyftj26it43kaczbyxm"; http_uri; nocase; content:"ipfs.runfission.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3map"; http_uri; nocase; content:"iphone-connect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/x/login/ses/session_index"; http_uri; nocase; content:"iqcu.fartit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/08lvks?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/09x77b?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0vabld?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/18pehw?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1gvaja?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/26zvs0?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2vj92g?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/35gvhn?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4otmb2?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4yxy1c"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6o9wzz?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9fruwx?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9jct9q?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/afaaoa?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/am10ch?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b6rwz2?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b6sh9b?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bper_banca"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bzn9pg?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cmvxje?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ctky4d?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/duueet?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eqtvvz?/facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/erbkjk?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f0ttv6?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f1sdet?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fopkyp?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fx4m28?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fywrlt?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fz8hit?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ghr3al?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gimn7a?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/go9ob8?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gsprzd?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/h0x9vt?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hh3iac?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hh86ur?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hpbvl8?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hvtcje?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hzqseh?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ifajc7?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ifmfwt?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ikkido?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/iku17t?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipzg4z?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/j0evku"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/j5rfag?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jjhtu6?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jlz6po?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jonryf?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jrtx1x?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jsttlk?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jzpj5l?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kd8x0m"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kthair?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lfrcnx?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ljxgs1?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lmkc57?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mari3q?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mltkf3?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/naf7nw"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/notifica0909"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nqwlvi?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/osluqg?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ox2urw?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p1vb9l?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/portale_b_p_e_r"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/portalebperapp"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/prpi5s?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/q5e04j?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/q7zblw?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qpmfoj?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/r7ifgg?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rbqscn?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rhm11n?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rs5lnu?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rwdiwt?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/shwcbr?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/skyy3x?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/to4egf?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tq7av5?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ujzct0?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ukhkqt?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uooqgo?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uvp1g2?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vao6qp?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vojehg?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vuxyra?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/w4rw8r?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wq4c3e?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xhvdb6?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xjslqu?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xogi59?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xxqlq4?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yiblwn?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yoqgmk?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yvjzbv?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yzp976?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/zuydx2?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/johan_jent_se/_layouts/15/doc.aspx?sourcedoc=%7beec8258f-a831-42dd-be37-a7186f3b17ee%7d&action=default&slrid=46cb5da0-f097-4000-fa3f-ad6d18add717&originalpath=ahr0chm6ly9qyw5zc29uzw50cmvwcmvuywrhyi1tes5zagfyzxbvaw50lmnvbs86bzovzy9wzxjzb25hbc9qb2hhbl9qzw50x3nll0vvogx5tzr4cu4xq3zqzw5hrzg3ri00qkzlswlowfbjwfp2c0xncgiydfnpz3c_cnrpbwu9b1dcnljfmkuya2c&cid=5712c764-51dd-4b60-bae5-9412676adf48"; http_uri; nocase; content:"janssonentreprenadab-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:w:/g/personal/dhankins_jecompanies_com/ezmchome9sxbl4kht3dj7mgbxdck6dbig800tfkd1szbja?e=dafgln"; http_uri; nocase; content:"jecompany-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dost"; http_uri; nocase; content:"jefigscredit.co.ke"; content:"Host"; http_header; classtype:attempted-recon; sid:200061323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dost/"; http_uri; nocase; content:"jefigscredit.co.ke"; content:"Host"; http_header; classtype:attempted-recon; sid:200061324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/code-eu1.jivosite.com/widget/jqqceif7de"; http_uri; nocase; content:"jivo.chat"; content:"Host"; http_header; classtype:attempted-recon; sid:200061325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7euow"; http_uri; nocase; content:"jtbtigers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/js/apibiji.php"; http_uri; nocase; content:"kangaroofruit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/contact-us/2970503358622564"; http_uri; nocase; content:"keap.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bt_internet"; http_uri; nocase; content:"koji.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200061329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bt_service_alert."; http_uri; nocase; content:"koji.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200061330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bt_teem"; http_uri; nocase; content:"koji.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200061331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/.tmb/cose//correos/?clp=327598322"; http_uri; nocase; content:"krizia.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200061332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/.tmb/cose//correos/seleccione_medio_de_pago.php"; http_uri; nocase; content:"krizia.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200061333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/index.html?"; http_uri; nocase; content:"kryptoconnect-support.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l3leph"; http_uri; nocase; content:"kutt.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200061335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dhtanx/office/index.php"; http_uri; nocase; content:"kuyhaa-me.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200061336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/amazon-account-locked-id9517453"; http_uri; nocase; content:"l.ead.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/amazon-signin-lf4nnwapv3xgyj"; http_uri; nocase; content:"l.ead.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bdbxhz"; http_uri; nocase; content:"l.ead.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bdczsh"; http_uri; nocase; content:"l.ead.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://abre.ai/eduz?userid=nwwuer4j"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://abre.ai/een1?userid=gkywgnp7"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://abre.ai/egic?userid=urrtk9bo"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://abre.ai/ei3z?userid=nl7mbjhz"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://bit.ly/3mlmufl?trackingid=asgfti6f&signature=newsletter"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://gorkha-uae.com/hrrmxpmk?dt=1"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://qrco.de/bd7zkx?userid=lp9u3b16"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://s.id/12ezw?userid=g8tmk6cv"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://s.id/12ezw?userid=iwhzddbk"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a0n"; http_uri; nocase; content:"l24.im"; content:"Host"; http_header; classtype:attempted-recon; sid:200061350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/login.html"; http_uri; nocase; content:"lbank.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200061351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/627d1ee47d4cb80020d558aa"; http_uri; nocase; content:"ldp.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200061352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/62985118879fa500156595cf"; http_uri; nocase; content:"ldp.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200061353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2022/09/sim2.html"; http_uri; nocase; content:"leroudemaroranaa.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/match_login/match.com/match/login1876.html"; http_uri; nocase; content:"lifeiswhatyoumakeofit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sw/w_11.js"; http_uri; nocase; content:"lin01.bid"; content:"Host"; http_header; classtype:attempted-recon; sid:200061356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/s/a74a48ad/ghnsf9jjv0_e2miyubuqpq?u=http://www.kntrwyy.radiomanantialesdevidainternacional.com/%23y2fybg9zlmdhcmnpyub0awvycmfhbnrpz3vhlmnvbq=%3d"; http_uri; nocase; content:"link.edgepilot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/40601p5zynl"; http_uri; nocase; content:"linkfly.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200061358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1rvqqm"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8nyk33"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9onwxq"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/assessoriabvonline"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/atdminhabv"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bvha"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/compassvisatteam?fbclid=iwar1y_woca8bfs4hb6doiqhzlulrfftr9ibsoxqbhrfckwlghzfxe2en2n6c"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cungrationoficial"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cupommagalo_2022"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dbsi.id"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fguugio"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hdyhid"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hifyiu"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ihkl"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jgbjg"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jrpvy"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mssdxd"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nuinvest"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nupagamentos21"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pagamentos.a"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/portalclientebv"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/promocaocasasbahia"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qk1m4v"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rubbishrubiish"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/suportedigital2"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vv06p6"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vvolr6"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/w1p0l6"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/woo3x4"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yahuumail"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yhooooo"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200061389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cupom-americana-site"; http_uri; nocase; content:"linkr.bio:443"; content:"Host"; http_header; classtype:attempted-recon; sid:200061390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/accountupdate12"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/activitlogs"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/adamson12345"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/admin__"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/adminboxalert"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/adminboxalerta"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/alcorbeil503"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/alertadminboxs"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/alertadminupdate"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/alertboxadmin"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/alertmoreadmin"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/aoladmin_"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appiesecure2021"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/att.net12"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attaccntsachieve"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attmailuser"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attservice67"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/britishtelecommunciation"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bt.o.world"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bt45y"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bt5644"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/btbroadteam"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/btbroadteam/"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/btcreator"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/btinternet12"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/btinternet21"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/btsecurelink/"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bttlee"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bupporrrt"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/currentl"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dfghjkjhgdfgh"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dhlpackage"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fearnomore"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fwfweflink"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ggbnhb"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ghvfg"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hendersome"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hthto204"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/imcreatorboard"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/imcreatorbt"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jfgjg"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jgbjgbjh"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/johnbrownn4811"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/johnbulljohn"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mail1083"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/makee4"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/marhfx"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/millie5566"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/newaccount12"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/oqk001?dza=21456"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/redirtoken981?dop=991154801"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sbccglob"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/secubtscjotj"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/status/blocked?username=attservice67"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/status/blocked?username=btsecurelink"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/submisin"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/supportleee"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/updategmxmail"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/verifyyourprotonmailemail"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/webmaioptus"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xxxx5"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yahooatt"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200061452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hxmytauaipuatatryalp"; http_uri; nocase; content:"linkup.fanlink.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200061453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/staging/staging/"; http_uri; nocase; content:"lisarobertson.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/certificates/schlesingergroup/noo-reply/"; http_uri; nocase; content:"lisarobertson.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/widgets/widg/"; http_uri; nocase; content:"lisarobertson.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mk/lin/lin/"; http_uri; nocase; content:"livablefutureblog.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/hannah-daly_live_nmit_ac_nz/_layouts/15/wopiframe.aspx?guestaccesstoken=ia5uzzon3iviku4f3pxemyhhabfwkpdjirpftfear%2fk%3d&docid=1_169208e425ed84fea9fd294a6886d67e9&wdformid=%7b06255f86%2d4bf9%2d4ee8%2dbd7e%2dfef81913a79b%7d&action=formsubmit"; http_uri; nocase; content:"livenmitac-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/hannah-daly_live_nmit_ac_nz/_layouts/15/wopiframe.aspx?guestaccesstoken=ia5uzzon3iviku4f3pxemyhhabfwkpdjirpftfear/k=&amp\;docid=1_169208e425ed84fea9fd294a6886d67e9&amp\;wdformid={06255f86-4bf9-4ee8-bd7e-fef81913a79b}&amp\;action=formsubmit"; http_uri; nocase; content:"livenmitac-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6wjbl"; http_uri; nocase; content:"lmy.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200061460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6t0faezv?_kx="; http_uri; nocase; content:"lnk.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200061461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d-3hbjpx"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d2cagqdm"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d_kqpmtx"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/db5fhxav"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dfxw4_sm=ojdszb15xdzzzv"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/di6hueus"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/di_qntwp"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/difsmpfx"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dkng9_k3"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dn3ujtph"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dnnpnd4y"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dr4agxum"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/drgcsgzw"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/drsgmgjm"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/drxkr5pj"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dvmqs3eb"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dxnhhybc"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e2dq2z7h"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e2p8spez"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e2stmj2s?=mtqeaywlyj1co3"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3fd6aks"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3g9qxhs"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e55ej5xx"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e5gzdpqa"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e5kpq2fp"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e_idwusk"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eacne62b"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/earmae2d%22"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/easrgdqg"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ecymrzgu"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/edvvp6ax"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ee5yc9ca"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eefrfkzq?=ojiouwexpg8h5s"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/effdee-j"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/egbbkcqr"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ehk85dzy"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/emmrycxb"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eqe_7fzg"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eqexis8b?=779auzfcptp61w"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/er86brtc"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/esh6x-2g"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/esjzqf_8"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/et-dkcdj"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eu3tad-d"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eu9zpb6z"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/euhr7uki"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ev55_yea"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/evbzscwd"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/evdj-yqh"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/evjgv5bv?=eme9jh5wippejx"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ew4xnymr"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ewfyckzm"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ews7fgtw"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/exc7h6tz"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ez2wd7tg"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ezztetjp"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/g45cgcft"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/g4qytsvf"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/g6y3fhkt"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gat_yr4c"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gbs4ecw8"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gczqssnv"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gepk78hu"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gezjhddn"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gfbpb8pc"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gfudg_bw"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ghktz_zc?=asrrne8hwgbpmp9"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ghktz_zc?=jjbpe2kkugganzg"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ghktz_zc?=yh2qhzgzcwjq4ri"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ghqhm_2d"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gjgskbfu"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gm9mx7ii"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gmhtpmas"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gnpurze8"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/grxqxr5n"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gtqqwvzn"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gvc3hmpq"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gw2x_btv"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gxsukn_z?=hmawyn6k"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gyrmxhc4"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gysdniaz"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200061542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/de/?code=1a468e385b9475ae1d0bfa645841a01f"; http_uri; nocase; content:"login-live.com-s02.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200061543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ppt9"; http_uri; nocase; content:"lp.vp4.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dqrxai"; http_uri; nocase; content:"lt27.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200061545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jal0cm"; http_uri; nocase; content:"lt27.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200061546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jnrv8a"; http_uri; nocase; content:"lt27.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200061547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/malfqj"; http_uri; nocase; content:"lt27.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200061548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qz2ci3"; http_uri; nocase; content:"lt27.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200061549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/zzmtdp"; http_uri; nocase; content:"lt27.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200061550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/claimskinn"; http_uri; nocase; content:"lynk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200061551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/stimulusbenefit9090"; http_uri; nocase; content:"m.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2fcannacoin.xyz/wp-includes/images/api.html"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2fmoviefreedownloads.xyz/wp/wp-admin/api.html"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2foasysfactory.com/wp-includes/css/api.html"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fbodycare.co.za/wp-admin/js/api.php"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fbridgecr.net/wp-content/uploads/api.html"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fcricsports.buzz/wp-content/plugins/api.html"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fevhservices.co.uk/wp/wp-includes/images/api.html"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fshop.blacklabelmattress.com/wp-content/upgrade/api.html"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fzangava.com/wp-content/uploads/api.html"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://qrs.ly/9gdxb1c"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ltau24h/"; http_uri; nocase; content:"ma-part-du-lot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2021/02/blog-post.html"; http_uri; nocase; content:"magyarpoosta.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/login"; http_uri; nocase; content:"maile02.oranga.far-facturea.appsuite.metabusinessanalyst.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/r/8ud1usio"; http_uri; nocase; content:"manylink.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"mascsosoerd.masecescrerd.mzztru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lnk.asp"; http_uri; nocase; content:"mb102.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/certificate-checker?login=false&amp\;originalurl=https%3a%2f%2fbit.ly.mcas.ms%2f3oynzgj%3fmcastsid%3d20893&amp\;mcascsrf=93b468fdf3284ff3f2c8f22a8a87cba95517d378569921d184b2090fc8102d80"; http_uri; nocase; content:"mcas-proxyweb.mcas.ms"; content:"Host"; http_header; classtype:attempted-recon; sid:200061569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/certificate-checker?login=false&amp\;originalurl=https%3a%2f%2fbit.ly.mcas.ms%2f3tbqbin%3fmcastsid%3d20893&amp\;mcascsrf=0f95c59a30af1e3a152874bd1ed8389e360301a106dd1613f05a98f6033f0361"; http_uri; nocase; content:"mcas-proxyweb.mcas.ms"; content:"Host"; http_header; classtype:attempted-recon; sid:200061570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sites/kellerwilliamshouston/linkout.cfm?office=http://www.hm.com&to=https://dev-fvazquejr4.pantheonsite.io/index.html#example@example.com"; http_uri; nocase; content:"members.har.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/cp/0ccc3066dc2bcd17/c?mi_u=87923176&mi_origin=&url=http://email.stickercanada.com/t?entity_type=2&entity_id=32534&email_pref_id=34785928&sent_id=1600423397&service_id=22668&redirect_url=https:/relievehotmailonly.cloudns.cl/imagineme/ionos.php"; http_uri; nocase; content:"mi.jetblue.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c?tagid=6565567-e43649793250da163478de2807c5c809&amp\;idc=77972&amp\;redir=https://loginingmocrosofttbox.pllatos.com/?e=@emba.schulich.yorku.ca&amp\;"; http_uri; nocase; content:"mmtro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/9468963092"; http_uri; nocase; content:"mono.fv-receipt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/references/ask-an-experts/electricity-company-salary-scale/"; http_uri; nocase; content:"mosoah.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/609890b8001f18095ac075fc"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/60deff002ca34f5aa4985ab3"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/6112452ca3f6e60d511bad0d"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/61e82b96ed8dd6152815c487#"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/61fbd0ed6ab665110baf7c8d"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/6216d491976b950bb612ee29"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/6217e24f976b950bb6148afa"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/622ef84817a64c6cae942da3"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/622f257117a64c6cae9476f7"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62528753e911ef58a52499d4"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/628e2c9dbd94a175bb6fe784"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/6291f287bd94a175bb75e94d"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/629b6312bd94a175bb849970"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/629c42c3bd94a175bb859032"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/629e7974bd94a175bb89ffeb"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62a096d7bd94a175bb8dc8ec"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62a44bd3bd94a175bb93ccfe"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62aab8d4bd94a175bb9d8b2d"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62ab0092bd94a175bb9df796"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62ac8b3b40535c37d67c13bd"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62b21abebd94a175bba7ec1b"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62b729dcbd94a175bbb0a072"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62baae34bd94a175bbb57e50"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62bafb7fbd94a175bbb5e6e7"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62dbab88971e3e097d4f6e0f"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/630e0e70c2748c14c10ef710"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jenetwood/untitled-form-1"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/layananpihakfacebook/resmipemblokiranfacebook"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rayzmania1/capitecbankdebitcheckmandate"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200061604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/epy7xq3y-office-365"; http_uri; nocase; content:"my.visme.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200061605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjaocseooeb.myjaocseeseb.uqmzwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjcasaeoeb.ca.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjcasaeoeb.ca.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjcasaeoeb.ca.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjcaseaecoeb.caaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjcaseaecoeb.caaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjcaseaecoeb.caaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjcaseeocb.caa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjcaseeocb.caa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjcaseeocb.caa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjcaseob.c.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjcaseob.c.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjcaseob.c.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjceaesacreaoecb.caoaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjceaesacreaoecb.caoaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjceaesacreaoecb.caoaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjceaesecroab.ccoaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjceaesecroab.ccoaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjceaesecroab.ccoaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjceasareaoecb.cao.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjceasareaoecb.cao.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjceasareaoecb.cao.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjceaseroab.cco.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjceaseroab.cco.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjceaseroab.cco.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacaseeob.oa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacaseeob.oa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacaseeob.oa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacasoesb.na.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacasoesb.na.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacasoesb.na.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsaceasceeob.oaaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsaceasceeob.oaaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsaceasceeob.oaaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsaceascoesb.naaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsaceascoesb.naaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsaceascoesb.naaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacesecob.oaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacesecob.oaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacesecob.oaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacesocsb.naa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacesocsb.naa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacesocsb.naa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacseob.o.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacseob.o.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacseob.o.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacsosb.n.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacsosb.n.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacsosb.n.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseacarsaeecob.oao.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseacarsaeecob.oao.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseacarsaeecob.oao.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseacarsaoecsb.nao.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseacarsaoecsb.nao.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseacarsaoecsb.nao.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseacsreaobc.oo.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseacsreaobc.oo.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseacsreaobc.oo.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseacsroasbc.no.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseacsroasbc.no.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseacsroasbc.no.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseaecacrsaeecob.oaoaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseaecacrsaeecob.oaoaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseaecacrsaeecob.oaoaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseaecacrsaoecsb.naoaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseaecacrsaoecsb.naoaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseaecacrsaoecsb.naoaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseaecscreaobc.ooaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseaecscreaobc.ooaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseaecscreaobc.ooaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseaecscroasbc.noaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseaecscroasbc.noaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseaecscroasbc.noaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/en/b/5j9l4"; http_uri; nocase; content:"n9.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200061679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2hhwdm"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200061680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6kxp6p"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200061681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hxnuzx"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200061682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k4jcff"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200061683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l4khtv"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200061684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pogdut"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200061685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/q3euu4"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200061686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qzadbp"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200061687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tutp27"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200061688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vimyln"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200061689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vwzsnu"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200061690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:x:/r/personal/ginger_gingerfountain_com/_layouts/15/wopiframe.aspx?guestaccesstoken=gpys8ex7ys1urrzbfeasvlexkodtrovmmcpn%2brsnebs%3d&amp\;docid=1_1882b07b5eb5643d2bdaa63426324ef0e&amp\;wdformid=%7b9bd54af1%2dee16%2d4e07%2d8d62%2d6e9b76e47512%7d&amp\;action=formsubmit&amp\;cid=9adf3e74-8cc1-4e36-b545-c9165fcafde7"; http_uri; nocase; content:"netorg6600800-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eml"; http_uri; nocase; content:"netvision-it.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eml/"; http_uri; nocase; content:"netvision-it.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/images/data/redred.html"; http_uri; nocase; content:"nihadtrading.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uae-post.com.ae/new%20dhl/torsion/index.php"; http_uri; nocase; content:"nuriero.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200061695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/bmmoka7mpahg/b/bucket-20220921-114421/o/index.html"; http_uri; nocase; content:"objectstorage.ap-mumbai-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/bmmoka7mpahg/b/bucket-20220921-114421/o/index2.html"; http_uri; nocase; content:"objectstorage.ap-mumbai-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdtal0a81zt/b/26367738384838sharepoint88983939/o/login.microsoftonline.com"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdtal0a81zt/b/3668284882934voiceplay/o/login.microsoftonline.com"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdtal0a81zt/b/887897899sharefile/o/microsoftonline.htm"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdtal0a81zt/b/bucket-20220614-1751/o/microsoftonline.htm"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdygadynczt/b/bucket-20220914-1108uoy87tr6edt/o/index.html"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/axb8nnxphkla/b/bucket-20220828-2154/o/indexseradon.html"; http_uri; nocase; content:"objectstorage.us-phoenix-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"oiazeiuiazolme.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/authorize/1662975258698217"; http_uri; nocase; content:"olx-pol-kxlsw2.hbjiaju.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/authorize/1663678320865003"; http_uri; nocase; content:"olx-pol-kxlsw2.kuantu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/authorize/1663678320865003"; http_uri; nocase; content:"olx-pol-kxlsw2.yashou.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=936f66742226eaf0&resid=936f66742226eaf0%21105&authkey=aitnwnmvuumu2oo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view.aspx?resid=cd71337cfb2b3ba9!1313&amp\;ithint=onenote&amp\;wdo=2&amp\;authkey=!ajwhinbbsa8ui98"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a7zxb1g"; http_uri; nocase; content:"onl.bz"; content:"Host"; http_header; classtype:attempted-recon; sid:200061710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hydh4kr"; http_uri; nocase; content:"onl.bz"; content:"Host"; http_header; classtype:attempted-recon; sid:200061711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wm2dp2c"; http_uri; nocase; content:"onl.bz"; content:"Host"; http_header; classtype:attempted-recon; sid:200061712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"online-helpchase.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/app/forms/view/zalxyved/a9adea36-d163-4d46-a3de-0e990d86e78e"; http_uri; nocase; content:"online.visual-paradigm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ions/index.php?email=redacted@abuse.ionos.com"; http_uri; nocase; content:"onlinecasinospark.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"onlinehelpchase.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1682449218/156e09d0ea8e294db3474e54a2df1dc9/download.htm"; http_uri; nocase; content:"padlet-uploads.storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ripleychile/formulario/formulario_opt_out/opt_out?spmailingid=46529866&amp\;spuserid=mtm1mjmzntkxntc5mqs2&amp\;spjobid=mjiwmti5njg1mqs2&amp\;spreportid=mjiwmti5njg1mqs2"; http_uri; nocase; content:"pages03.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200061718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/delivery/checkout/receive/9164738"; http_uri; nocase; content:"paket-lieferung.apexpluspoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/#"; http_uri; nocase; content:"pandude-mint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"paozeia.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2021/02/blog-post.html"; http_uri; nocase; content:"paypal-inc-userupdatenuber7925570844.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sharepoint/sharepoint-3d7/"; http_uri; nocase; content:"pegc.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200061723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/orn.html"; http_uri; nocase; content:"perspectivart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/.documents/check-info/adobe%20signed/adobe/"; http_uri; nocase; content:"pflexport.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/zoll-abzeichen-aufn%c3%83%c2%a4her-patch-grenzwache-schweiz-254138890280.html"; http_uri; nocase; content:"picclick.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200061726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/includes/api-irs.html"; http_uri; nocase; content:"pichaapp.africa"; content:"Host"; http_header; classtype:attempted-recon; sid:200061727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/juegos-ninos/habilidad"; http_uri; nocase; content:"pocoyo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fia8mx"; http_uri; nocase; content:"ppt.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200061729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fva4wx"; http_uri; nocase; content:"ppt.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200061730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fvakzx"; http_uri; nocase; content:"ppt.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200061731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fvllvx"; http_uri; nocase; content:"ppt.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200061732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d0uv8808qzu0hxnpoqtl"; http_uri; nocase; content:"preferences.convertkit-mail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cpsess3669307974/horde/imp/dynamic.php?page=mailbox#"; http_uri; nocase; content:"premium57.web-hosting.com:2096"; content:"Host"; http_header; classtype:attempted-recon; sid:200061734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/home/?pboow084mu"; http_uri; nocase; content:"presence-theultimategift.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/preview/104287/sites/61058225432167468/index"; http_uri; nocase; content:"preview.mailerlite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/preview/110767/sites/61786017102825222/index"; http_uri; nocase; content:"preview.mailerlite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/preview/123455/sites/63214900840761106/index"; http_uri; nocase; content:"preview.mailerlite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200061738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0/sharepoint-rd1-fresh/"; http_uri; nocase; content:"privatedomaincontact.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=1"; http_uri; nocase; content:"proceedencryptions.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/msword/"; http_uri; nocase; content:"profytaddyct.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/irx/8egjz3y7iy2o27vslfr61fjpzt.php?0=&.verify??guce_referrer=ahr0chm6ly9sb2dpbi55ywhvby5jb20v&guce_referrer_sig=aqaaaba99nmgr9inqoyu5mi3asjqfyjcpatd_a8modgjxpnxynmo8n5zxdi8ezv7gfypzosc_rpmz0hyfdck0olmxnmb6tpfznd5encxtci3e56k0vz3psl6poiodvee6vv6vaibzqdjcyabahdiaf7gx2w9xrgmch4orbe2vczo9an_"; http_uri; nocase; content:"promo-sys.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/irx/?i=i&amp\;0=ripe@nameshield.net"; http_uri; nocase; content:"promo-sys.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/emailfwd/show.php?usernum=350311855&amp\;formid=3879"; http_uri; nocase; content:"pub5.bravenet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2rc41txe"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/actueel03"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bcfuja3v/?ht"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bcfuja3v/?https://www.google.com/"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ewqwwwsl"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hi1opzhz"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/in1b4ru"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ofcclfoq"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/r6wxsyai"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/stwj0uvm"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwxh38rr"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wt7bjibp"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ytmc2hww"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yvqvuzxe"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/zv8d_zyc"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hixeto"; http_uri; nocase; content:"qr.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200061760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bczdkg?userid=ad1e2wno"; http_uri; nocase; content:"qrco.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200061761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bd5q48"; http_uri; nocase; content:"qrco.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200061762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bdfevh"; http_uri; nocase; content:"qrco.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200061763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bdfngf"; http_uri; nocase; content:"qrco.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200061764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dir/secure/"; http_uri; nocase; content:"qualityscrubset.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/secure/"; http_uri; nocase; content:"quantum-walletconnect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/secure/walletsconn.php"; http_uri; nocase; content:"quantum-walletconnect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jeh2aebbsh97"; http_uri; nocase; content:"quip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qv7malu8n7cz/you-have-some-messages-pending"; http_uri; nocase; content:"quip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nhv--mdzerq--vnwvjydqquc/pzg--neyjlund--ipscsdlmu/index.html#redacted@abuse.ionos.com"; http_uri; nocase; content:"rachelholz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nhv--mdzerq--vnwvjydqquc/pzg--neyjlund--ipscsdlmu/index.html#user@example.net"; http_uri; nocase; content:"rachelholz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raekoatcsrnocn.rakaseeoaseroour.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raekoatcsrnocn.rakaseeoaseroour.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raekoatcsrnocn.rakaseeoaseroour.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raekoatnocn.rakaseeoour.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raekoatnocn.rakaseeoour.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raekotncsron.rakaseoouasero.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raekotncsron.rakaseoouasero.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raekotncsron.rakaseoouasero.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raekotnon.rakaseoou.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raekotnon.rakaseoou.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raekotnon.rakaseoou.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200061782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raekotnon.rakaseoou.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rakasaecsroocu.raekoetnaseroonr.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rakasaecsroocu.raekoetnaseroonr.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rakasaecsroocu.raekoetnaseroonr.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rakasaeoocu.raekoetnonr.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rakasaeoocu.raekoetnonr.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rakasaeoocu.raekoetnonr.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rakaseocsrou.raekotnonasero.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rakaseocsrou.raekotnonasero.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rakaseocsrou.raekotnonasero.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rakaseoou.raekotnon.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rakaseoou.raekotnon.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rakaseoou.raekotnon.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raoseakcsrorcou.rakoeasaserouern.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raoseakcsrorcou.rakoeasaserouern.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raoseakcsrorcou.rakoeasaserouern.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raoseakorcou.rakoeasuern.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raoseakorcou.rakoeasuern.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raoseakorcou.rakoeasuern.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raosekocsrrou.rakoasuenasero.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raosekocsrrou.rakoasuenasero.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raosekocsrrou.rakoasuenasero.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raosekorou.rakoasuen.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raosekorou.rakoasuen.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raosekorou.rakoasuen.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasekoatcnocn.rakaseeeeooaur.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasekoatcnocn.rakaseeeeooaur.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasekoatcnocn.rakaseeeeooaur.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasekotcsrncon.rakaseooaseroueea.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasekotcsrncon.rakaseooaseroueea.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasekotcsrncon.rakaseooaseroueea.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasekotncon.rakaseooueea.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasekotncon.rakaseooueea.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasekotncon.rakaseooueea.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raskasacsrecoocu.raekoeaseroteenoanr.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raskasacsrecoocu.raekoeaseroteenoanr.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raskasacsrecoocu.raekoeaseroteenoanr.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raskasaecoocu.raekoeteenoanr.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raskasaecoocu.raekoeteenoanr.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raskasaecoocu.raekoeteenoanr.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raskasecsrocou.raekotnoaseroneea.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raskasecsrocou.raekotnoaseroneea.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raskasecsrocou.raekotnoaseroneea.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raskaseocou.raekotnoneea.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raskaseocou.raekotnoneea.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raskaseocou.raekotnoneea.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasoseakcorcou.rakoeaeesuaern.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasoseakcorcou.rakoeaeesuaern.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasoseakcorcou.rakoeaeesuaern.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasosekcsrocrou.rakoasuaseroeeena.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasosekcsrocrou.rakoasuaseroeeena.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasosekcsrocrou.rakoasuaseroeeena.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasosekocrou.rakoasueeena.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasosekocrou.rakoasueeena.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasosekocrou.rakoasueeena.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9mxost?evgdh"; http_uri; nocase; content:"rb.gy"; content:"Host"; http_header; classtype:attempted-recon; sid:200061844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9mxost?sston"; http_uri; nocase; content:"rb.gy"; content:"Host"; http_header; classtype:attempted-recon; sid:200061845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fiexaf"; http_uri; nocase; content:"rb.gy"; content:"Host"; http_header; classtype:attempted-recon; sid:200061846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hqfrat?gcflga"; http_uri; nocase; content:"rb.gy"; content:"Host"; http_header; classtype:attempted-recon; sid:200061847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jpasq7"; http_uri; nocase; content:"rb.gy"; content:"Host"; http_header; classtype:attempted-recon; sid:200061848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jpasqz"; http_uri; nocase; content:"rb.gy"; content:"Host"; http_header; classtype:attempted-recon; sid:200061849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/t5in63?pwjd"; http_uri; nocase; content:"rb.gy"; content:"Host"; http_header; classtype:attempted-recon; sid:200061850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xueevj"; http_uri; nocase; content:"rb.gy"; content:"Host"; http_header; classtype:attempted-recon; sid:200061851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ba5ge"; http_uri; nocase; content:"rcl.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200061852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dwi5d?/pages/services/2022"; http_uri; nocase; content:"rcl.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200061853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jrrmq"; http_uri; nocase; content:"rcl.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200061854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mw80e?./help-accountcenter-service.gtempurl"; http_uri; nocase; content:"rcl.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200061855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pztsj?./accountcenter-service"; http_uri; nocase; content:"rcl.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200061856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/medical?pc_url=https://health.usnews.com/doctors/li-lei-1012630&securl=ghy1rdnmwlqytqu2rfrhtf27kllqk76w&type=wap&wap_url=https://mail.ionos.com/"; http_uri; nocase; content:"readmodel.m.sogou.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"reamaam.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pe/comparador-creditos-hipotecarios"; http_uri; nocase; content:"rebajatuscuentas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ew4xir1"; http_uri; nocase; content:"rebrand.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200061860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/i8v7232"; http_uri; nocase; content:"rebrand.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200061861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/o1lz8r3/?email=registrar@nameshield.net"; http_uri; nocase; content:"rebrand.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200061862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/s7jsnz4"; http_uri; nocase; content:"rebrand.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200061863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/home.php"; http_uri; nocase; content:"rectifywebwallet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"redatofadesafe.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/111/"; http_uri; nocase; content:"reflexologyegypt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"reikreitel.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mailservice?url=https://ci4.googleuser=%20conte%20nt.com/proxy/qrclxpwgysi1rf2vddyxuf1xk3fdjdd--avtzkbfsw-51gwhfk2qjkj2=%20qpw%203yxkyvveihj_m4yd1wfepj1jyj-fr9ltz3pgqwlzo9hgjtntqw3tmxaujonfw0iyt-a=s0-=%20d-e%201-ft&proxy=yes&key=c7d1173f601f75093c848d58166fbed4"; http_uri; nocase; content:"resize.yandex.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200061868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6e9zk5"; http_uri; nocase; content:"reurl.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200061869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/g2emzn?coinbase?shiny"; http_uri; nocase; content:"reurl.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200061870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xeknoz?confirmation"; http_uri; nocase; content:"reurl.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200061871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xgmxr1"; http_uri; nocase; content:"reurl.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200061872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2d0jazx1eky5/click-here-to-verify-your-email"; http_uri; nocase; content:"rezunz.quip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nats.sern/5/rnnp.php"; http_uri; nocase; content:"rgcgov.edu.bd"; content:"Host"; http_header; classtype:attempted-recon; sid:200061874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2021/02/blog-post.html"; http_uri; nocase; content:"riderctposten.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/widgets/ea8a/postch.php"; http_uri; nocase; content:"robinettearchitect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/widgets/ea8a/redirect.php?id=7c18c315d71119489192f48f2b84ad73"; http_uri; nocase; content:"robinettearchitect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/validieren"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200061878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ndltqxfz"; http_uri; nocase; content:"s.pointerpro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1659657545763x218727606757116440/vc.html"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1661579854461x333665918085419600/index%20new.html"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1662380478060x513998377438234600/ix.html"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1662567373229x779238078226475000/fx.html#x@x.com"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1662614585247x113432212858644020/0987654323405o6789065uytr5678iuyt.html#a@b.com"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1663018729985x498369598269489540/shared_document.html#a@b.com"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1663121478306x670080554591245400/n09876567809876512345lo09.html"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1663190347963x799571763592599200/3m1cr0s0ft.html"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1663576535147x841775360002985300/cment-pr-iling-emailing-colco.html#example@example.com"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/progressivebank-uat/index.html"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/s3-service.update.delivery.adress.awsdjtygtfdaghfajgskzgnbeca3/1awfawegas.html"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/safiepace/refn26.html"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/theretaisdkjgndsfajkxbnakmsdnfaskmsgslfmgaawf18/2awegsega.html"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/www.securemicrosoftonenote/hm/$rhzg5iz.html"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/www.microsoftonenotes.com/hm/$rhzg5iz.html"; http_uri; nocase; content:"s3.eu-west-1.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200061894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l0/https://lnkd.in/dxnhhybc/1/01000181eecab6cf-769da54d-7b69-4125-84f0-dc49abe930cd-000000/t_-tkxz7q3rbxjaufqrdl3ugqcy=277"; http_uri; nocase; content:"s4r9mj97.r.us-east-1.awstrack.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200061895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaaeeeiescssceoe.saaccacerseoorria.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaaeeeiescssceoe.saaccacerseoorria.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaaeeeiescssceoe.saaccacerseoorria.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaaieesecsesoe.saccacseoeriaor.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaaieesecsesoe.saccacseoeriaor.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaaieesecsesoe.saccacseoeriaor.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaaieesecsesoe.saccacseoeriaor.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaaieesecsesoe.saccacseoeriaor.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaeieesacseoe.saccsecoiaarser.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaeieesacseoe.saccsecoiaarser.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaeieesacseoe.saccsecoiaarser.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaeieesacseoe.saccsecoiaarser.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaeieesacseoe.saccsecoiaarser.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaeieescsceoe.sacacsceorira.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaeieescsceoe.sacacsceorira.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaeieescsceoe.sacacsceorira.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaeieescsceoe.sacacsceorira.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaeieescsceoe.sacacsceorira.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaiceesecsesoe.sascacseoeraior.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaiceesecsesoe.sascacseoeraior.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaiceesecsesoe.sascacseoeraior.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaiceesecsesoe.sascacseoeraior.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaiceesecsesoe.sascacseoeraior.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaieeecescssceoe.saacsacerseoorrai.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaieeecescssceoe.saacsacerseoorrai.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaieeecescssceoe.saacsacerseoorrai.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaieeecescssceoe.saacsacerseoorrai.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaieeecescssceoe.saacsacerseoorrai.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaiseecseoe.saccseoicar.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaiseecseoe.saccseoicar.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaiseecseoe.saccseoicar.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaiseecseoe.saccseoicar.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaiseecseoe.saccseoicar.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaeaiescssceoe.saacaceseoorcriaas.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaeaiescssceoe.saacaceseoorcriaas.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaeaiescssceoe.saacaceseoorcriaas.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200061933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaeaiescssceoe.saacaceseoorcriaas.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200061934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaeaiescssceoe.saacaceseoorcriaas.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaeaiescssceoe.saacaceseoorcriaas.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaeaiescssceoe.saacaceseoorcriaas.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaiasecsesoe.saccaseoeicaoras.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaiasecsesoe.saccaseoeicaoras.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaiasecsesoe.saccaseoeicaoras.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200061940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaiasecsesoe.saccaseoeicaoras.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200061941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaiasecsesoe.saccaseoeicaoras.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaiasecsesoe.saccaseoeicaoras.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaiasecsesoe.saccaseoeicaoras.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaicseecseoe.sascseoacir.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaicseecseoe.sascseoacir.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaicseecseoe.sascseoacir.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaicseecseoe.sascseoacir.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaicseecseoe.sascseoacir.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieceesacseoe.sascsecoaiarser.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieceesacseoe.sascsecoaiarser.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieceesacseoe.sascsecoaiarser.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieceesacseoe.sascsecoaiarser.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieceesacseoe.sascsecoaiarser.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieceescsceoe.sasacsceorari.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieceescsceoe.sasacsceorari.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieceescsceoe.sasacsceorari.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieceescsceoe.sasacsceorari.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieceescsceoe.sasacsceorari.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieseecasoe.sacseoiacserr.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieseecasoe.sacseoiacserr.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieseecasoe.sacseoiacserr.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieseecasoe.sacseoiacserr.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieseecasoe.sacseoiacserr.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaisceesoe.sacseoicr.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaisceesoe.sacseoicr.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaisceesoe.sacseoicr.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaisceesoe.sacseoicr.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaisceesoe.sacseoicr.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200061999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacsecsesoe.sascasceoeai.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacsecsesoe.sascasceoeai.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacsecsesoe.sascasceoeai.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacsecsesoe.sascasceoeai.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacsecsesoe.sascasceoeai.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaecescssceoe.saasacesceoorr.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaecescssceoe.saasacesceoorr.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaecescssceoe.saasacesceoorr.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaecescssceoe.saasacesceoorr.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaecescssceoe.saasacesceoorr.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiascsceoe.sacacseocriaas.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiascsceoe.sacacseocriaas.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiascsceoe.sacacseocriaas.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200062102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiascsceoe.sacacseocriaas.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200062103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiascsceoe.sacacseocriaas.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiascsceoe.sacacseocriaas.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiascsceoe.sacacseocriaas.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiescssceoe.saacacesceoorr.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiescssceoe.saacacesceoorr.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiescssceoe.saacacesceoorr.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiescssceoe.saacacesceoorr.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiescssceoe.saacacesceoorr.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaicasecsesoe.sascaseoeacioras.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaicasecsesoe.sascaseoeacioras.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaicasecsesoe.sascaseoeacioras.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200062114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaicasecsesoe.sascaseoeacioras.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200062115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaicasecsesoe.sascaseoeacioras.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaicasecsesoe.sascaseoeacioras.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaicasecsesoe.sascaseoeacioras.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaieacescssceoe.saasaceseoorcraias.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaieacescssceoe.saasaceseoorcraias.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaieacescssceoe.saasaceseoorcraias.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200062121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaieacescssceoe.saasaceseoorcraias.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaieacescssceoe.saasaceseoorcraias.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaieacescssceoe.saasaceseoorcraias.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaisacseoe.saccsecoiaas.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaisacseoe.saccsecoiaas.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaisacseoe.saccsecoiaas.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200062127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaisacseoe.saccsecoiaas.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaisacseoe.saccsecoiaas.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaisacseoe.saccsecoiaas.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saicsacseoe.sascsecoaias.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saicsacseoe.sascsecoaias.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saicsacseoe.sascsecoaias.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200062133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saicsacseoe.sascsecoaias.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saicsacseoe.sascsecoaias.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saicsacseoe.sascsecoaias.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saicsacsien.a.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saicsoiasioen.o.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiecascsceoe.sasacseocraias.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiecascsceoe.sasacseocraias.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiecascsceoe.sasacseocraias.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200062141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiecascsceoe.sasacseocraias.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiecascsceoe.sasacseocraias.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiecascsceoe.sasacseocraias.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiscasoe.sacsceoias.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiscasoe.sacsceoias.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiscasoe.sacsceoias.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200062147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiscasoe.sacsceoias.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200062148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiscasoe.sacsceoias.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiscasoe.sacsceoias.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiscasoe.sacsceoias.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"sasaeiicecseecrson.iseaiorcseoeosninveri.ipcvku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/macros/s/akfycbxldfmsdlmc1xmyfvmhpijk0qxsnxurlh95jzz3qcvmodhollh-cgwk3ql47_ntzyajzw/exec"; http_uri; nocase; content:"script.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1/webmail/webmail.php"; http_uri; nocase; content:"sdfoil.cam"; content:"Host"; http_header; classtype:attempted-recon; sid:200062154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/13/webmail/webmail.php"; http_uri; nocase; content:"sdfoil.cam"; content:"Host"; http_header; classtype:attempted-recon; sid:200062155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2/webmail/webmail.php"; http_uri; nocase; content:"sdfoil.cam"; content:"Host"; http_header; classtype:attempted-recon; sid:200062156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3/webmail/webmail.php"; http_uri; nocase; content:"sdfoil.cam"; content:"Host"; http_header; classtype:attempted-recon; sid:200062157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4/webmail/webmail.php"; http_uri; nocase; content:"sdfoil.cam"; content:"Host"; http_header; classtype:attempted-recon; sid:200062158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5/webmail/webmail.php"; http_uri; nocase; content:"sdfoil.cam"; content:"Host"; http_header; classtype:attempted-recon; sid:200062159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6/webmail/webmail.php"; http_uri; nocase; content:"sdfoil.cam"; content:"Host"; http_header; classtype:attempted-recon; sid:200062160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7/webmail/webmail.php"; http_uri; nocase; content:"sdfoil.cam"; content:"Host"; http_header; classtype:attempted-recon; sid:200062161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8/webmail/webmail.php"; http_uri; nocase; content:"sdfoil.cam"; content:"Host"; http_header; classtype:attempted-recon; sid:200062162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9/webmail/webmail.php"; http_uri; nocase; content:"sdfoil.cam"; content:"Host"; http_header; classtype:attempted-recon; sid:200062163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"sdzakfahz.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.lzpytu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seacseccasorirn.osaeacesseocnaoeosnmer.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.lzpytu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.lzpytu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.lzpytu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.lzpytu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.lzpytu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.lzpytu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200062213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/postenno_9.html"; http_uri; nocase; content:"seonewsservic.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/we%20logz%20sure/"; http_uri; nocase; content:"serviceuspaym-client.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nwansgd6ahijos18s0/$!&amp\;)*!$0/$!&amp\;0$!&amp\;0.html"; http_uri; nocase; content:"sfo3.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nwanspinvgsbayuis90ahsf78/$&amp\;!&amp\;()&amp\;0/()!$&amp\;(0.n.sp.!&amp\;$.html"; http_uri; nocase; content:"sfo3.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nwnespinvs7wh017aj/%26%21%24%28%29%24%21/%26%21%24%2604%21%26.html#ogledi.claims.sofia@generali.com"; http_uri; nocase; content:"sfo3.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sungmai7d6gsbni8179w9dkal7357/&!$)(&!$!$))!)0/&!$)&!$())(!.html#redacted@abuse.ionos.com"; http_uri; nocase; content:"sfo3.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/teend9blck0nx1v8a88qu016a40x/!!!!)!($!)$!!@/&!$)!@&!&.html"; http_uri; nocase; content:"sfo3.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:b:/g/personal/jean-claude-fernandes_sgdb91_com/exk2a_c6xsxouopoew83oxib65oghw_co2bz33les1rdxw"; http_uri; nocase; content:"sgdb91700-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0nlined0cufile0365/indexx.html"; http_uri; nocase; content:"sgp1.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/49d4d1db-49d4d1db-4b4b6f-49d4d1db-4b6f-41c3-9cc9-8bf82941c3-9cc/index-001.html"; http_uri; nocase; content:"sgp1.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/j7trucking467/3sndftr.html"; http_uri; nocase; content:"sgp1.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/m1cr05oft.0n1i3efile/indexx.html#test@example.com"; http_uri; nocase; content:"sgp1.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/11c1i3ucrsjaeqnyxinop6ad5rxo"; http_uri; nocase; content:"share.hsforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1fni_ent2sao6wqv0vzdn7g8nl9d"; http_uri; nocase; content:"share.hsforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1onniqroftvoytwpvbgznvgd5749"; http_uri; nocase; content:"share.hsforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1q6hj0hs8qeiyr1t5ntqimgd8cyx"; http_uri; nocase; content:"share.hsforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1whluifnasr6s4ov9skogswd5n96"; http_uri; nocase; content:"share.hsforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1zwug5hvmsuik9mhaflsx3gd9wnt"; http_uri; nocase; content:"share.hsforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/basic.php?k=d63621ef3dc01735479befc13f97ec7fdb68991d"; http_uri; nocase; content:"shared-document.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/product/h5zibdt"; http_uri; nocase; content:"shoppy.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200062233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dhtvx"; http_uri; nocase; content:"shorturl.at"; content:"Host"; http_header; classtype:attempted-recon; sid:200062234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nqgu1"; http_uri; nocase; content:"shorturl.at"; content:"Host"; http_header; classtype:attempted-recon; sid:200062235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ful6dt"; http_uri; nocase; content:"shrtco.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200062236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tw3yr2"; http_uri; nocase; content:"shrtco.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200062237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3agjmgjyyplkvvrxs8gjhycxxceohkhjciyqw26qvn_oow/?username=johnmc@mllaw.net"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200062238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/_aano8qiogx5k6fj-ccpaju3w_9agsdwvzxtmabx0thicq"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200062239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cabaybt8lak9mo5zhwmptynbxnuoi0eyg6jf6fm4vvmnxq"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200062240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/caccwingwl1ucrtyuohvlf8x9wtawho4wow8_hogisxrrq/"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200062241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cadgaaxmhb7khuhj9pqz5rjrpjvblumqwifacimbglzara/"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200062242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eabibfvu2cs824kdijdrs-n_zwu-ye4drkasdgdocktsta"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200062243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/faeicp2oyfw_naknpocdptlhquxwgak2eon_lwl7emv3hw"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200062244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/faf2wyczyf0diaxx2t0k3bm2brlf186bujorpf-vcnwi4g"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200062245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fahkl94fvnfknstb5uqmc0mucdmpmfi8uulh5pqx6iikag"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200062246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fakjhyaxtduuvxg_-v_uyjupuv4hrs-e26tghs4dirphmw"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200062247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gadk5qtwprcw9xcsiruyy7c2yvdlok8ojizuvwwe57sy8a"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200062248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/iabv_pct--a7fwj67qbveixv2qtxmxpwokkpnna-b_pncw"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200062249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laaxelwyqjsshibteka89h50ds8oqcaui9ytnpw0uknc2q"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200062250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/labqfn6wmesyycilz-rhqyvyyxvjc8n3rlqzikgwmq1dba?key=98ffa81a26fcc724be5d713a985f365f&redirect=https://www.amazon.com"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200062251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nabo48lq3y5efwoyti9jsn8vo9ma8ipm9j4uo7j2w98vba/"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200062252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/paacavdp-l6nejrchvlcslzttfbf06tverf20iynpkofaw"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200062253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/paaipkogokc5zi9akqmvrapfdrth7ynsrjmup8sdhhcrnw"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200062254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pacfw0z2apxcddfcln2tsmddr8tnetpi7yvt-gvmkc0xfg"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200062255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vaayqhcjskxbeu4bvfljtto23b9x5xoeaqfnj9td7f_94g"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200062256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vadquwag-e9jdh7sry_osyvtl4ufr7orzvspw0lxmyeohg"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200062257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/publish/xhrdvc"; http_uri; nocase; content:"simp.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200062258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d/c8p32jnftqeza01h/c/4041353/1"; http_uri; nocase; content:"simplero.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a/sy4norton.com/setup/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/amricalturs.net/download4/microsoft-office-365"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/amricalturs.net/ks3/microsoft-office-365"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/metamask-ios.com/metamaskchrromeextension/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/metamask-ios.com/metamasklogin/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n12-netempresarial.com/empresa-nerd-n12/in%c3%adcio"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/newservices.website/orange-mobiles/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/newservices.website/service-reglement/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/newservices.website/service-reglement/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/e9d24c72/23524457"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/habbotuttogratis/assignments"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/libretyreserve"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/libretyreserve/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/protectedinmprovmnt44/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/safetycheck427064200647221/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/verifycheckpointpaqes/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/traconf-it.com/flashyfile/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/019businessusersbt782btsignin/secure-update-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/02amr/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/04-am/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/08ie-securepage-facebook"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/09securebusinessusersonly-/secure-bt-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/0iey-securepage-facebook"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/0range-bank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/12noreplybtuserconnect365offic/secure-bt-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/1mailxverificatio/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/2-orangebank-salva/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/3-orangebank-vetch/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/302dir/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/3254798fr78/uigiugi"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/4-orangebank-toto/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/443edxsjkl8/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/565f34/microsoft-office-365"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/65h7t65ygtdw5f4/bt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/65q-securepage-facebook"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/7wr/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/91186co/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/98w72securebusinessbt-01/secure-update-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/a3y-securepage-facebook"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/abonnevocalweb/accueil?authuser=5"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/abuse-privacy/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/access-office-aud-msg-us/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/access-office-docxpdf-call-net/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/access-salesorder/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/access-voice-mail-pay-us/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/accs-office-ml/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/accs-p-o-us/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/accsoffice-usa/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/activationagrisecuriplus/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/adrianoferriani/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/alert-app-pages/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/amldk/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/amporangefr/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/amsohappy/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/app-mobile-uuid/recovery"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/appli-ob-securite/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/appli-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/appli-obank-serv/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/appli-scur-obankps/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/applkactu/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/apps-authentification-forte-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/apps-mbl2/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/apps-obank-apli/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/apps-secure-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/apps-securite-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/aqwsas"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/asdfghjklhgfdsdfgh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/assdffee"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/assdfr/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/atendimento-online-emissao/in%c3%adcio"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/atendimentomarnobre/p%c3%a1gina-inicial"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/att-home/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/att-mail-update/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/att-managements/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/att-net-/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attemailfox7/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attemler7/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attfeatures/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attlattlattlatt/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attmailcustomerupdate/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attmaillogservise/attmail"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attndattndatt/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attnet-104921/att"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attnetli/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attnetlogsignmail/att-net"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attnetlogsservce/att-net"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attonline00/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attserv111cust/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attttstttegegrsksw/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attudnie/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attupdateobo/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attweb22/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attweblysiteupgrade/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attyahoomail7/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attyahooohroffice231/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/authen-secure-obank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/authentification-apps-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/authentification-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/authentification-orangebank-eu/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/authentifications-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/awspage"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/azssdf/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/b6ljxyar/information-page-report"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/background-in"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bacopremolista/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/baltimoreassessoria"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bambe/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/banquepostalebanqueetassurance/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bbroadband110/home?authuser=4"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bbtbroadband/home?authuser=9"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bcp-mille/home-page"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bctw/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bdbbbb/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/benachrichtigung-sparkasse/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/biorange/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bletoemisao/in%c3%adcio"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/broadbandplc/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bt-2022-user/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bt-cloud-voice-review-voice/bt-voice-cloud"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bt-clould-preview000112/voice010101010bt-cloud?authuser=8"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bt-pdf-receipt-payment/www-bt-pdf?authuser=8"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bt-users/secure-business-bt-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bt-voice1010010/bt-voicemesaage10120201002?authuser=8"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btaert/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbillreview/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbraodbandteam/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbriadbandteam/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbroadbandlin/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbroadbandplc/home?authuser=7"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbroadbandplc1/home?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbroadbandteam/home?authuser=5"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbroadbandweb/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbroadli/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbtbtbtbtbtcomm/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbusinessx/bt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btcloudpaymentinvoice202000/httpsbtcloudvm-voice-new?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btcloudvoice-mv0001/home?authuser=3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btconnectbusiness/btconnect"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btconnectmailserver/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btconnectsecurebusinesbtcom/bt-connect"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btcustomerservice/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btee0/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btemailwebmailer/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btintern/bt-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btinternet42day/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btinternetco/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btmailerupdatee/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btmv-voice-notice011/btvoicemessage?authuser=8"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btnvm-urgentnotice/btvmnew-note?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btserver10/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btservicebill/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btsuporteamsup/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttbriadbandteam/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttbusinesssss/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttelecom/home?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttelecomm-/home?authuser=5"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttelecomm0/home?authuser=2"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttelecommication/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttelecommservice/home?authuser=5"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttelecommunication-plc/home?authuser=2"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btuiytretyudfgjh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btwebmailww/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btwebsuppor/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btweeb/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btworkingteam/home?authuser=5"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btworkking/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btworldwide/home?authuser=4"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/businesbtnewbroadband-hub/update-bt-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/business-btbtb-office365/secure-bt-business-com?authuse%20r=3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/business-btbtb-office365/secure-bt-business-com?authuser=3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/businessbtxpress/update-bt-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/buxtonbreweryofficial/official"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/capitaloneloginus/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ccjkc/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/certiauthavril/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/cgnvzmx/att"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/chamekesa/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/chamekesa/accueil?authuser=3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/chamfare/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/charlisto/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/clickpagenewlogin2021"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/clxyxsnh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/coinsbuysellswapcryptocurrency/?fbclid=iwar2isl9xfxxgcxtftml2hmcl_dglhshlkfkpdotycyqu-qjqqfdqm9whtfm"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/comfimobiekdofl/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/community-pages-app/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/community-relief-program/crf-dispatch-illustration"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/community-relief-program/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/condado-duo-luis-pagan-/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/confirmation-orangabank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/confirmationacces"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/confirmationacces/verify-pages"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/connectionperdue/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/connectolo/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/connectsvqq"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/control-service/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/controlpanel-ovh?/48700315fr640w648"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/couldie/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ctz03"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/currentlyserver/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/cvrpd/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/d-aps-orge-secure/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dambt/home?authuser=6"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/damilolwas/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/damilosadde/home?authuser=7"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dasbvmk/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dbs-com-g/privacy-policy"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/debloquagedescompte/page"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dfghjhckuyf/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dfghjhl/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dgjhjjojhgffg/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dhddfhdfhcom/att"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/directionmessageriemonespace/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/directionobweb/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dispo-obankweb/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/divsec20/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dkdfkazii-ofoqisjaz1wk/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dkekkeole/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/doelza/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dshrkuoiuhgkjkjlkmjyhhfhj/bt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/eaglemaddez/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/eikp-securepage-facebook"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/emreszra/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/eruiizetyo/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/erydkjsdkhfgjfhjdkh/bt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/es-pace-clien-ts/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espa-ce-clien-ts00/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espa-ce-de/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espace-orange-vocal/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espace-vocal-orange/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espace-vocalorange-ref0325/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espace-vocalorange-ref0325/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espaceclient-orange03html5/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espaceclientscuritvfvfdsvsf/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espacemessagerieorangesms/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/estomcasting/accueil?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/etyajdnxnskoeprlwyaxbdhfkrituy/btconnect"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/exodus-wallet-shared-rewards"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fa-ctu-re-es-pace00/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fabienlaracico004/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fabiodhouman"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fac-tura-tion-esp-ace05/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/factu-re-clients/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fantasticpage-in"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fatct-ure-es-pace01/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fatherplac/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fattiu776/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fatu-ration-esp01/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fcg133/att"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/feelblessed/bt-business"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/feriousca/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ffduefuefsbc/att"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fhiefeiih/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/flmkgknzklfgklfgk/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/form-recovery/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/form-recovery/details"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/france-banque/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/frdfhhh/yahoo-mail"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fscdsh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fssghsfd/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/gajiview/yahoo-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/gdhbfcxzx"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ggfhftwyjfj/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/gmxmailerfttfd/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/gmxupdate/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/golppu/page-recovery-2022"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/gsdeaq"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/h6wrjhcs6tt9fwphome/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/hbxchx"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/hccwc/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/hfggdfyhcom/yahoo-mail"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/hfgggggggggggggg/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/home-bt-updates/bt-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/home-pages-recovery/details"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/hommem-loggiinnformm/home?authuser=2"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/httpbtbroadband/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/htvvss/home?authuser=3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/hvgfdcftfttf/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ii-securepage-facebook"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/incomm-sso"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/inf0ssgss/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/infoline439pent0line/accueil/untitled-page/fdsls32?authuser=6"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/invoice-payment-pdf/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/invoicehomepdf/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ivxep9/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/jcnvvn/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/jdvdksf/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/jio-tower-installation-apply/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/jjjjeeebbbbb/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/jlkb6rf/apps-support"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/jmjmnhvdc/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/jnbhgv/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/juif00012/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/kflkllf"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/kjhydc6yh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/kjnbhgvcfd/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/klklklkutu/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/koiuld2dkjcxnjk2s/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/landbankredirect/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/leafadd/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/leafpadrode/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/lidl-bg22/bg?fbclid=iwar3vyju-ddafnwfna5hgyotzwb0pjkbcfmwydmyrixienrmngx7gzksmlom"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/line01-centre/accueil?authuser=2"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/lkdiur24/accueil/secureli20"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/lkoeir3190/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/llllogin-home-pageaa1/www-btconnect-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/log-inpagenew"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/loltym/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/magazineluiza22/promo%c3%a7%c3%b5es"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mailcustomerservices/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mailtoh/home?read_current=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mailyahooservicesverifynow/home?read_current=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mallhitoh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mallofuaq/halaman-muka"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/manager3-controlpanel-ovh"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/maxatserv/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/maxmaner/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mcwdbvefjberjrwgnwriviwr/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/messagerie-vocalorange-gms-mms/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/messagerie-vocalorange/accueil?authuser=2"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/messageriehtlmxccvsdfvf/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/messor/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mldof"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mmanuel/attyahoo"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mndirilivin-online/verifikasi"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mnoko"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mobile-apps-pages/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mobile-redirect-system"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/monbonusclicetmoi/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mssft22/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mv-voicepage/home?authuser=8"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/myatt-home/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/myattworldconnection90/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mycoinwallet/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/n12-acessologinempresanet"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/n12-acessologinempresanet/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/name29/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/necrologieinfosfroravocal/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/nefsuddma/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/new-service/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/newbtmissedcall/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/newuploadpage"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/newvoicemail/home?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/nextprojectpage"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/nextprojectpage2022"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/njsdghjdqhdkhqk/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/notice-pagesecure"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/noticeplaypagenew2021"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/noticepublicpagenew2021"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/noticeservice2022"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/notifcationnoticesystempage"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/nouveau-sms-message-vocal/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-certifier/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-identifweb/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-seccurite/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-securite-/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-securite-eu/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-securite/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-securites/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-service/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-verifie/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob2clieconnec/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob4direconec/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/obank-authentificat-forte/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/obank-securit/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/obespaceweb/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/office-com-mail/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/office-srv-cnt-us/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/offiice-voice-com/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/olarico--fact05/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/online-zkb-0"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/online-zkb-1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/online-zkb-2"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/onlineemail890/home?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/onlinefifthercheckaccout/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/or-pro-mobiles-et-forfaits/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/oracoservclie/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangbnk/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orange-b-securite/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orange-espace-client1/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orange-facture1/admin"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orange-forfaits-et-mobiles"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orange-forfaits-et-mobiles/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orange-forfaits-et-mobiles/accueil?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeb-190/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeb171/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeb221/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeba/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeban/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangebank-22/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangebank-r/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangebank-sc/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangebank-secure-secure/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangebanksecurite/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangebannk/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeclient2/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeclient2/fact458"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangehtmlcofirmationqcdsvcdvf/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeibank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeinfosvocalnews/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangemms/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangemyconnect/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeportailretun/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangesecurishtmlvnc/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangesupp"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangesupp/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangevocalwebmaildigital/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/oranggebank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangiebank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ormas/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/p2j/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pagenewlogin2022"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/paissnsns/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pass-press/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pass-securit-societe-generale/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pay-ez-vo-tre-fa-cture/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pay-ez-votre-fact-ure10/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pay-ez-votre-fact-ure10/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/paypal-customer-services/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/paypal-loginn/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pfherjwlsnmcyelwudy/home?authuser=3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pkm6w/recovery-page-support"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pleasecheckpoint2021"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pleaseclickplaypagenew"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pleaseclicktopage"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/portailscurit-orange/accueil?authuser=6"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/portailscuritorange/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/postacerticodplusaccaccueil/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/preferences-coordonnees?bredbanquepopulaire.fr/authentification/transactionnel"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/private-bt-policy/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/projectupdatepage2022"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/protonmailservice/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pstbrand"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pushfarcot/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/quickmailer/yahoo-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/quickteamservice/yahoo-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/r64t9/security-page-recovery"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/recatss/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/redirect-acctpages-uuid/details"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/redirectme-to/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/redirectmybank/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/regionglobaleactivate/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/regionphfrancecentrerelations/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/regionphp/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/register-reward/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/regl-ement-fac-tu-re/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ret4e/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/review00zzz01/bt-home-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/reviewappspagerviicee/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/richcoff/bt-business"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/rimekahsdjg/summary_page"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/rnorangefisrt/12547op"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/rvcefte/recovery-suport"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sadcfasdc?facebook-security/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/salimkaso/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/saudipost-spl"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sbcglobalm/home?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sbcglobalmaillerrrr/att-net"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sbcglobalnetbellsouth/att-yahoo-mail-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sbcweb22/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/scbwebmail/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sdbdbdbdbd/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/seccure-business/secure-business-bt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/section-ob-web/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/secure-bt-homevoice01010120/home?authuser=8"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/secure-ob-/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/secure-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securebtusers/businessbt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securenoticepage2022"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securiplus0101/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securite-app-obank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securite-ob-service/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securite-obank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securitee-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securites-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securree/home?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securritee-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/seecurebusiness-/bt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serv-appli-ob-fr-2022/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serv-appli-obank-fr/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serv-espace/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serv-ob-authentification/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serv-ob-securite/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serv-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serv-obank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serveur-communication-box/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/servi-orangbank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/service-apps-obank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/service-orangebank-fr/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/service-orangebank-securi/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/service-securite-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/servicenewlogin"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/seuysihofficebtbusinessbrir/bt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sgdfgetf/att"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sharepointofbandhan/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/shgeudh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sign-in-eml-com/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sitatt/home?authuser=3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sitgandii/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ski03/strona-g%c5%82%c3%b3wna"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/soeyankandi5/bt-business"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/szdgsdhgd"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/szoquwz"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/taffac1/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/tergelinca"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/terlenaaja"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/texaschildneurology/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/tg5oltrd0/information-page-business"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/thenewstartpage2021"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/theservvvvvvv11ajw2/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/titat6867gghm00/%d8%a7%d9%84%d8%b5%d9%81%d8%ad%d8%a9-%d8%a7%d9%84%d8%b1%d8%a6%d9%8a%d8%b3%d9%8a%d8%a9"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/tl8ba2l/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/tq4rdkn8/security-page-info"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/tsaftez1/information-page-recovery"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/tyryrtrtrtyyt/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/uiora"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ukhdggdfgd/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/uooh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/update-allreadypage"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/updatesecure"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/updatingnewpage"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/upgrade-bt/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/usaconnectingcom/att-yahoo"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/usaoush/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/utereue/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/utututttu/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/uuhqv/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/uujejuz/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/uyt6rf/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/uzl2kop/?faacebook.com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/v-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/venmo-loginusa/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/verif-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/verificat-mobi-obank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/verificat-mobile-obank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/verificat-orangeb/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/verificati-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/verifmail03/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/vfbjf/btconnect"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/vfdffktt/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/vghgn/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/viewespaceclient-orange03dml/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/viewyournewbill/bt-business-btconnect"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/viewyourrbilll/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/vjsdhdfidjasi/btconnect"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/vkjjjerljjarea/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/voipnotevocale/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/votre0101/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/votre04/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/votre1/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/votre12/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/votreone/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/walletliveconnect/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/watchingregard/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/wazxbnm/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/webespaceclient-ref8/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/webmailbt/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/webmailbt23/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/webmailnotification093/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/weebmail123/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/weelcomsign/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/wrttt/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ws0l"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/www-signin--com-cancel-reset/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/www-voice-en/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/xcccjcdhasks/btconnect"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/xmicrosoftoficew/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/xvhfefef/bt-business"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/xxbmicrosoft/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yah000/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yah00mall/home/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahoo-mail-verify/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahooend/yahoo"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahookwhjf/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahoolip/yahoo"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahoomailactivation"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahoomailconfirmination/home?authuser=9"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahoomailingdesk/yahoo-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahoonice/yahoo-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ydkyf/yahoo"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ymchitkweed08"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/zkb-online-3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ztt5zazu/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/info.html"; http_uri; nocase; content:"solucionesachgt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"soufritont.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/de/home/onlinebanking/startseite"; http_uri; nocase; content:"sparka-kundendepot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/de/home/onlinebanking/startseite"; http_uri; nocase; content:"sparka-kundenenaufsicht.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/de/home/onlinebanking/startseite"; http_uri; nocase; content:"sparka-kundengeschaft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/w8e4hmg3et"; http_uri; nocase; content:"sparka-kundeninstitut.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/60oghgwcy4"; http_uri; nocase; content:"sparka-kundenkredit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmnpcxctmrmvrmu4oybc1fkx6gwpxqfpvkxrn9wtr434tu/"; http_uri; nocase; content:"spheron.infura-ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200062849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/stt-c4968a"; http_uri; nocase; content:"sprw.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200062850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/index.html/"; http_uri; nocase; content:"sssayanthan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/index.html/card-verify.php"; http_uri; nocase; content:"sssayanthan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/index.html/email-verify.php"; http_uri; nocase; content:"sssayanthan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/index.html/login.php"; http_uri; nocase; content:"sssayanthan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/index.html/personal-information.php"; http_uri; nocase; content:"sssayanthan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hwpahwpa9hwpa7"; http_uri; nocase; content:"st.fanlink.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200062856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?gclid=eaiaiqobchmi94bpzz-j-givg9kych0yigapeaayasaaegiwu_d_bwe"; http_uri; nocase; content:"star-atla-experienc.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:b:/g/personal/mandyb_steiner_co_za/exxq1passetnrojoe83fzboboxufoggwb7uvmyfqbionla?e=4:su8jhq&amp\;at=9"; http_uri; nocase; content:"steinercoza-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/themes/twentyfifteen/css/read/chinavali/index.php?email=jsmith@imaphost.com"; http_uri; nocase; content:"stolizaparketa.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200062859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/guide/en/pdf-online-access-813co6iagv/steps/1844666"; http_uri; nocase; content:"stonly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1lordman1man3/kelmanco.html#email=info@domain.tld"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1lordman1man3/oscman.html"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1lordman1man3/oscman.html#email=info@domain.tld"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1lordman1man3/oscman2.html#email=info@domain.tld"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1lordman1man3/oscman2.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/acc03lzzl4m3izm03iauserpowa.appspot.com/index.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/algebraic-pact-316913.appspot.com/index.html#jbell@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/anaagc040gdyacgd0dyuser.appspot.com/index.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ciat3tdtttd53c3e5userp.appspot.com/index.html#jr@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ciat3tdtttd53c3e5userp.appspot.com/index.html#paul@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/clientid4dunptjlryzrift3nrlomi160gqntzgznajujcnbszq8w/index.htm"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cmc111/cdo-nwst1.html#helpdesk@widomaker.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cmc111/chaidon.html#a@b.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dhngw6p6rwrwnuv6vnuse.appspot.com/index.html#brianvillacarlos@legalshieldcorp.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/g58t3e588ddgmdeddauth.appspot.com/index.html#jim-shelvy@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gu1r0utjruhjkukrxhauser.appspot.com/index.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/https3a2f2fofficeuser2fowa2fresourceopenidmsdclientid727c9d/index.html?authuser=0"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/indettn/oscman2.html#cert@soc.tdc.dk"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/indettn/pdflmanco.html"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/indettn/pdflmanco.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/indettn/zdewaman.html#example@example.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kkkqkl633qn6kq3lqssiiddnenen.appspot.com/index.html#jbell@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kkkqkl633qn6kq3lqssiiddnenen.appspot.com/index.html#t.voit@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/logon_id63757945b-32c6-49b0-83e6-1d93765276e7/"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/logon_id63757945b-32c6-49b0-83e6-1d93765276e7/index.html#martin.manasek@ruk.cuni.cz"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/logonservices8g7gs65gs9bs66vds7bd9nd/index.html"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lttna/zkele1.html#acctbilling@widomaker.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lttna/zoscman414.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/aliexpressautoindex.html#dan@danaxtell.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/index.html#a@b.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/kayindex.html#eimaste@stinpriza.org"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/myautoindex.html#example@example.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/myofficeindex.html#@yorku.ca"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/myowngeneral.html#eimaste@stinpriza.org"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/newkaraindex.html#a@b.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/newmineindex.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/webappindex.html#example@example.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/owuddqd9dqqdddq9qd0caerq.appspot.com/index.html#stevewilliamson@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/projerroro0h5j5ro0jrrj.appspot.com/index.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/q90qqqar22r229r292euser.appspot.com/index.html"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/q90qqqar22r229r292euser.appspot.com/index.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qaqonqfaqvq0fni33q0x.appspot.com/index.html????dddd"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qaqonqfaqvq0fni33q0x.appspot.com/index.html???v"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/riltool/mrkautoindex.html#a@b.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rrdar99rt9qraraq99euser.appspot.com/index.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/s0pts0apttxpp00atarrauth.appspot.com/index.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sqlseiceteroeswalesuserw.appspot.com/index.html?dd9uj&amp\;rip=1&amp\;nojavascript=1&amp\;ifkv=au9nccwgqgxybveyj_rmt1ijh5qqlfd7xhs9ssn0ocwja5n3jm1gnfvdcuhslngz3y67_oax8ufr&amp\;followup=https://storage.cloud.google.com/sqlseiceteroeswalesuserw.appspot.com/index.html?dd9uj&amp\;service=cds"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/staging.maintainancecomponeta.appspot.com/fcocnew.html"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/staging.maintainancecomponeta.appspot.com/nvhdjgtpl8txagtoccpyscuekxctc7j3kpg5bbugwqv0kemeas313lqehufuifcl6el9vtvomhrfbjbpxbg6qrnsg5sz3dyaiqor%2c%2520ffx6khej2lavfftroaizcq99hjdn3f4hs6gdeg2qodfyhobl8zonx6lez2dafyafc6spylufytfvuzn1jsioh4u6xpsbsqxqgh.html#icann@tecnocratica.net"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/staging.maintainancecomponeta.appspot.com/sydlasgendomain.html#winnie@soupro.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tilittjkilot/kakaaautoindex.html#a@b.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ttn5/raja.html#a@b.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ttn5/raja.html#william@nabaza.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ttn5/raja2.html#a@b.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ttn5/udunwa.html"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/user517497679326978.appspot.com/index.html"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uth0uax3t3uh30ttna0nnuser.appspot.com/index.html#jbell@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yyw77ywnn68weyew6euserq.appspot.com/index.html#rosalefua@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1827435283/1827435283.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/anjumaa0059.appspot.com/indsadadex.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/anjumaa0059.appspot.com/indsadadex.html#alfredo@tecnocratica.net"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bbss-urltest-public/docomo_20210726_01.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bbss-urltest-public/docomo_20210910_01.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/brand.html#cl/13669_md/1/788/1401/22/1025434"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/brand.html#cl/13695_md/1/788/1401/109/376564"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/brand.html#un/13664_md/1/455/1401/112/814109"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/brand.html#un/13695_md/1/788/1401/25/339407"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/linkqs.html#cl/29040_md/1/4631/3798/112/984664"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/linkqs.html#cl/32440_md/1/4628/3798/112/984664"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/linkqs.html#cl/32621_md/1/4628/3798/112/984664"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/linkqs.html#oop/29237_md/1/4629/3798/112/984664"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/linkqs.html#oop/29627_md/1/4629/3798/112/984664"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kekvmftbijqr/qarqoiskwcbx.html#ezacvbnkpm?cbbbbcccs2ptcxvckcdcc5csc3pjpckzfcbbbbc"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/newuserlpo/index.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/onlineupdate/vendors/to2.htm"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pemotion/tixrin.html#/ytk3zstywfhgqtrevnj2amjnsuj2y01athbtukdvaxvdl2faem9wk0c5befnwerjm3rgqnbnzuxqwxk5c3hvuexjd1zud0twm0r0wk4xukltzutwdwvrakx1zwfdbfm5eeirwvgzdjlovg89"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/reaganstarkyjs/fqh9haa.html#tizioebsr.6x4ivkd4em5v9fgqt?f1tdqwcc4vybcxfhvcdcnvcyc45jphdc7cbbb4p"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/srvrs-quarantine-update.appspot.com/index.html?email="; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sstoragert/linkqs.html#cl/19939_md/1/4441/3808/112/984664"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sstoragert/linkqs.html#un/19995_md/1/4542/3682/112/984664"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/teampass/ha231120/hrf2zsdf/newb.html#2243022fe5715752yo615523864ez9739qk24hnr139714jz"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uvyzcsiggb.appspot.com/pduqg.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wjscsfikph.appspot.com/twava.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200062943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/008009aa-0c78-42dc-a70d-c23181f54038-bucket/validatesession19/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/008009aa-0c78-42dc-a70d-c23181f54038-bucket/validatesession20/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/008009aa-0c78-42dc-a70d-c23181f54038-bucket/validatesession21/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/008009aa-0c78-42dc-a70d-c23181f54038-bucket/validatesession22/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/008009aa-0c78-42dc-a70d-c23181f54038-bucket/validatesession22/index.html#corinne@zilch.nl"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/008009aa-0c78-42dc-a70d-c23181f54038-bucket/validatesession23/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/008009aa-0c78-42dc-a70d-c23181f54038-bucket/validatesession24/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/02416b2d-e521-48e0-9d61-d6495062cb37-bucket/steps1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/02416b2d-e521-48e0-9d61-d6495062cb37-bucket/steps2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/02416b2d-e521-48e0-9d61-d6495062cb37-bucket/steps3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/02416b2d-e521-48e0-9d61-d6495062cb37-bucket/steps4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/02416b2d-e521-48e0-9d61-d6495062cb37-bucket/steps5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/02828cfa-e421-4462-9568-7a45f46fa5fe-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/02e32dae-2d4c-432f-bab5-e95d0db36172-bucket/rfq11012.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/058fa26d-f991-4b96-83cb-fdb1c52b040f-bucket/brigt3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/058fa26d-f991-4b96-83cb-fdb1c52b040f-bucket/brigt4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/05d07142-ed07-4096-9a5a-22b46343a8d2-bucket/continue.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/073f0681-64f1-4f27-9986-a7cbcb285e97-bucket/servermail1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/073f0681-64f1-4f27-9986-a7cbcb285e97-bucket/servermail2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/073f0681-64f1-4f27-9986-a7cbcb285e97-bucket/servermail3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/073f0681-64f1-4f27-9986-a7cbcb285e97-bucket/servermail4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/073f0681-64f1-4f27-9986-a7cbcb285e97-bucket/servermail5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/085b9b78-0ab2-44d7-9e89-f616947a8290-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0891749f-909e-4267-9438-457e22431647-bucket/grace1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0891749f-909e-4267-9438-457e22431647-bucket/grace2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0891749f-909e-4267-9438-457e22431647-bucket/grace3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0891749f-909e-4267-9438-457e22431647-bucket/grace4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0891749f-909e-4267-9438-457e22431647-bucket/grace5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/09380f13-ffb4-4157-af2d-193b1a8c105e-bucket/regime/voicenotice.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/096593ac-2eca-4a4f-80f0-5daab89ec1f3-bucket/proj.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0a39a5ba-dba3-4fb5-bff3-5e73de94c728-bucket/12xxvcv/0a39a5ba-dba3-4fb5-bff3-5e73de94c728/0a39a5ba-dba3-4fb5-bff3-5e73de94c728/0a39a5ba-dba3-4fb5-bff3-5e73de94c728/0a39a5ba-dba3-4fb5-bff3-5e73de94c728/0a39a5ba-dba3-4fb5-bff3-5e73de94c728/0a39a5ba-dba3-4fb5-bff3-5e73de94c728/0a39a5ba-dba3-4fb5-bff3-5e73de94c728/0a39a5ba-dba3-4fb5-bff3-5e73de94c728/uxb.htm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0a39a5ba-dba3-4fb5-bff3-5e73de94c728-bucket/fredbox/taramfred/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0a86fac1-63ac-4139-b8ca-3038c914e256-bucket/worker1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0a86fac1-63ac-4139-b8ca-3038c914e256-bucket/worker3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0a86fac1-63ac-4139-b8ca-3038c914e256-bucket/worker5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0b4126b5-bbd3-4b45-b0ae-f1b78fe697e0-bucket/index%20(2).html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0c0a62dc-4401-49af-bfa1-511cf49cffd4-bucket/linkeen.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0c9132ec-9643-4af4-8c51-078fb5efab0f-bucket/invc0201.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0eb56d45-f892-4f30-8ef0-9d2483720f9d-bucket/exlude1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0eb56d45-f892-4f30-8ef0-9d2483720f9d-bucket/exlude3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0eb56d45-f892-4f30-8ef0-9d2483720f9d-bucket/exlude5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0f0875a9-0684-4a75-9451-6ca06ba8e377-bucket/strick1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0f0875a9-0684-4a75-9451-6ca06ba8e377-bucket/strick2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0f0875a9-0684-4a75-9451-6ca06ba8e377-bucket/strick4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/14a2f715-cb61-421c-a1c7-966bcb291f16-bucket/indexx.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/14e8eb22-d4a9-4105-85d8-08261460a270-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1547eea2-6309-4177-9176-edeb6351a5b4-bucket/rfq11002092.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/169e4e52-d3b7-4707-a5f2-e05132127c62-bucket/webupdate.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1730ad2e-b5ea-4199-9ef5-016339155306-bucket/indexl.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/17841cbb-7f9a-40ad-a1aa-1667c7c1d5ba-bucket/mailingserdomain1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/17841cbb-7f9a-40ad-a1aa-1667c7c1d5ba-bucket/mailingserdomain2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/17841cbb-7f9a-40ad-a1aa-1667c7c1d5ba-bucket/mailingserdomain3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/17841cbb-7f9a-40ad-a1aa-1667c7c1d5ba-bucket/mailingserdomain4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/17841cbb-7f9a-40ad-a1aa-1667c7c1d5ba-bucket/mailingserdomain5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/18f11056-0746-4859-a59b-65e7cb150f5a-bucket/mails.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1ad8dec7-46ca-4414-aad2-d40b9d393bd6-bucket/dd9/index.html#tanaka@kohyo.nl"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200062999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1c20489e-d757-45a8-83ed-6231dbca099b-bucket/in2foodaustralia%20document%20folder/scanned%20storage.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1c61e284-5354-48a5-b13a-be7c8f3b7105-bucket/mailingserdomain6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1c61e284-5354-48a5-b13a-be7c8f3b7105-bucket/mailingserdomain7/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1c61e284-5354-48a5-b13a-be7c8f3b7105-bucket/mailingserdomain9/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1c8da883-9442-41fa-941c-80be6481d56f-bucket/bulet3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1c8da883-9442-41fa-941c-80be6481d56f-bucket/bulet5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1d912b44-1c41-4688-8a21-b749fbb550e7-bucket/way.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1fe526bb-5b83-4613-8376-b6e16c8c0a2f-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/22533933-4ba9-40b8-bf76-a822fb2028cc-bucket/one/view%20doc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/22b5ad07-22d8-4137-a753-eed64883b182-bucket/overlay1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/22b5ad07-22d8-4137-a753-eed64883b182-bucket/overlay2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/22b5ad07-22d8-4137-a753-eed64883b182-bucket/overlay3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/22b5ad07-22d8-4137-a753-eed64883b182-bucket/overlay4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/22b5ad07-22d8-4137-a753-eed64883b182-bucket/overlay5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/23a45a7b-21d5-43e1-8dcd-acf81abec49e-bucket/papybuggy/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/279b9836-1e2a-45b4-8fe2-48ef945ca842-bucket/noseit/skechtix.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/28b92292-b3a3-4fc5-8f8e-0126dba82ee9-bucket/ggenn.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2be46cf3-38c7-4fe4-8523-6f8d0ea7934a-bucket/files-folder.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2de8538b-36c1-4a81-962b-efd465fad6e6-bucket/access/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ec9db52-41a4-4bb3-b073-3a67d64aab20-bucket/van1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ec9db52-41a4-4bb3-b073-3a67d64aab20-bucket/van1/index.html#phishing@irs.gov"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ec9db52-41a4-4bb3-b073-3a67d64aab20-bucket/van10/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ec9db52-41a4-4bb3-b073-3a67d64aab20-bucket/van2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ec9db52-41a4-4bb3-b073-3a67d64aab20-bucket/van3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ec9db52-41a4-4bb3-b073-3a67d64aab20-bucket/van4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ec9db52-41a4-4bb3-b073-3a67d64aab20-bucket/van5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ec9db52-41a4-4bb3-b073-3a67d64aab20-bucket/van6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ec9db52-41a4-4bb3-b073-3a67d64aab20-bucket/van7/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ec9db52-41a4-4bb3-b073-3a67d64aab20-bucket/van8/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ec9db52-41a4-4bb3-b073-3a67d64aab20-bucket/van9/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2f22cbec-21c0-4980-abb9-1e3d02c89ed0-bucket/nn/new.html?websrc=faha6bjxmi7zyn69jydvr7qzrrznl6bypvjbplculjxepanokflmweioat4i709xpqurdrqkko07beqbtctacpsxps4hwagacxesc6xlzqimckbfslzpknmcuegq5ueu4ovwouxbpnqrv7d8iqin4xjvwn1y4reptvi60vehcongaoro1engcnwau68nk95hwo0fg6b1wax4v4bc1sibjphk7z8sjdqh9t0mhxmvflbeedzjuwm1zmf0kt6tzsqrsz9lpsuapkajwwfp8qoxucitj8wwcfizeecjwuqi4scey8&dispatch=355&id=758933"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/34ba28df-6627-4ad1-bd1c-40bda3dec365-bucket/linkedln1.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/36faf61a-ec14-4175-8810-c1c4aff18763-bucket/bcse2356/test1.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3881952d-6ae0-4f5a-abc7-c38c7b0c1cb2-bucket/dropboxddddropbox/dr0pf1leupdatesabsnew.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3ad30708-8b27-4f22-b0ca-4cdcaf01ae7c-bucket/1pdf.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3ad30708-8b27-4f22-b0ca-4cdcaf01ae7c-bucket/pdf.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3d20107d-a0ab-454d-b952-f0cc43872720-bucket/servermailing10/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3d20107d-a0ab-454d-b952-f0cc43872720-bucket/servermailing6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3d20107d-a0ab-454d-b952-f0cc43872720-bucket/servermailing7/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3d20107d-a0ab-454d-b952-f0cc43872720-bucket/servermailing8/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3d20107d-a0ab-454d-b952-f0cc43872720-bucket/servermailing9/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/40bed425-0d9e-4c62-bb8f-9c413d2d7aa8-bucket/rfq11012.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/41800835-442e-4753-85b2-a15887bb85c3-bucket/draes1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/41800835-442e-4753-85b2-a15887bb85c3-bucket/draes2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/41800835-442e-4753-85b2-a15887bb85c3-bucket/draes4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/459518fb-8d2b-4356-912a-b57525b246c6-bucket/odere.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/459518fb-8d2b-4356-912a-b57525b246c6-bucket/odere.html?email=#jomama@fbi.gov"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/485f987b-e484-4311-9b2c-d2a64f5d7454-bucket/j.p/xi/lankkk.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/49afd6b0-06f1-4f83-88e2-76ac3ff68da4-bucket/servermailing1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/49afd6b0-06f1-4f83-88e2-76ac3ff68da4-bucket/servermailing5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4df9f8c6-4f96-4ae5-a9bb-82e51d2a9d9f-bucket/offer_rfq11002092.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/52a20491-52b3-4341-bbd8-cc274a4b1eee-bucket/box.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/53205beb-e9f1-4cdc-88ad-5732e17b1dd0-bucket/emailserver6/index1.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/53205beb-e9f1-4cdc-88ad-5732e17b1dd0-bucket/emailserver8/index4.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/53205beb-e9f1-4cdc-88ad-5732e17b1dd0-bucket/emailserver8/index4.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/53205beb-e9f1-4cdc-88ad-5732e17b1dd0-bucket/emailserver8/index4.html#username@domainname.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/56261e77-9ba3-49fb-9f57-11c14aea3fde-bucket/renwe.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/57b68e2f-bb84-4026-9d12-c3fc1b90f9b6-bucket/&!$0-.&!$!$$)jar.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/57dca71d-e20f-4685-b2df-15267dd2689e-bucket/stpors4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/58a29414-dac1-4f44-b09d-a6b351e56199-bucket/rfq11012.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/58d4908c-793b-4b7c-a88c-8f1c7d7d5523-bucket/vrfpage/vrfportal.html#orders@kohyo.nl"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/58d9cb92-a511-4227-836b-a45fefcd7b6c-bucket/clippas.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/594ae299-05ea-4930-b9e5-c5342625ca4a-bucket/11777/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/59baaf79-b41b-409d-ba7c-f4acaeaa8a24-bucket/domainmailserver2/index2.html#x@x.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5aa19b42-9761-4d35-84af-d58addd91bbc-bucket/emm/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5d2aef15-c3e7-42bf-aaa4-ae75eb8d1b92-bucket/payer1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5d2aef15-c3e7-42bf-aaa4-ae75eb8d1b92-bucket/payer2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5d2aef15-c3e7-42bf-aaa4-ae75eb8d1b92-bucket/payer4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5d2aef15-c3e7-42bf-aaa4-ae75eb8d1b92-bucket/payer5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5dccdcb9-a76a-423b-8109-b4923299ea78-bucket/talbrt/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5ecea662-ae2e-435d-b8dc-404c6b30fe4a-bucket/office/login.html?kwzgg=ldpuid5o7h9taojb4ituykl&ofqqudmq=bmpxzrttey5kjqls&vgloxegoh=2b5oxpmtrdxu2tzllgnij9pavc7c&fqzvmwkmz=geil6syshzlz4sjbmglnid"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/60262110-3cae-4646-ade9-887cd5639d84-bucket/yz/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/608e4ea4-adfc-4b4c-b938-74fd8881b6ea-bucket/og/webmail.htm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/61480a35-422f-4cc7-b58c-f487bc6c5b65-bucket/securesecure/hfjjfkvkd.htm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/61480a35-422f-4cc7-b58c-f487bc6c5b65-bucket/uwmdhdf.shtm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/62ac7c12-f24c-43d1-b3a1-581162f4c42e-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6382ea8e-bed0-4a80-8167-117c945bde45-bucket/pa/newpage.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/63e3d9b6-39e8-44f5-8f71-bd9064380a09-bucket/tf/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/648d03ef-0b94-494f-824d-f1c768eeb80b-bucket/file/portal-1.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/648d03ef-0b94-494f-824d-f1c768eeb80b-bucket/xxa/portal-1.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/65dbb473-51c0-4bcf-9a87-99b7110c0818-bucket/gmx-login.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/66096d55-0650-4645-b1f6-d85fb3e0ad75-bucket/dee.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/67b4550b-48f0-4229-8d91-c686e9c6f07f-bucket/calme1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/67b4550b-48f0-4229-8d91-c686e9c6f07f-bucket/calme2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/67b4550b-48f0-4229-8d91-c686e9c6f07f-bucket/calme3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/67b4550b-48f0-4229-8d91-c686e9c6f07f-bucket/calme4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/67df6301-ff56-43f4-9949-f6e5c7dd6686-bucket/fond/tim.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6acb3647-1d42-46c9-ab36-0ae7631e5389-bucket/rfq11002092.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6b1e919f-20bf-4f29-8357-6f39e7d5f17f-bucket/rfq11012.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6e7e5395-69fc-4f7e-905b-c8cb66cef347-bucket/secure.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6fb54de1-0ac2-4845-b632-3431d9f3bc49-bucket/updatedomain13/index1.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6fb54de1-0ac2-4845-b632-3431d9f3bc49-bucket/updatedomain14/index4.html#user@domainname.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/70b1299a-8d76-4da1-82fb-4d1cf8ed10c6-bucket/wiko-file/encrypted%20file.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/73764aa4-36f4-451c-ac26-d45e25726a8b-bucket/creditstatement/newindexphpg.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/75013cd2-8113-4647-9e9d-62adb2b603fb-bucket/rrddrrtt.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/75dea5ea-ddd5-401a-919c-b87686e7c296-bucket/lite2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/75dea5ea-ddd5-401a-919c-b87686e7c296-bucket/lite3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/766e2246-0cb2-4006-a3ac-b025b19e324c-bucket/4iivoio.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/766e2246-0cb2-4006-a3ac-b025b19e324c-bucket/edu0991.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7810f4f8-2a81-468f-9279-549518cb2827-bucket/hg/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/79e0eebf-9221-4180-806b-e1dcfdb099fd-bucket/270920221/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/79e0eebf-9221-4180-806b-e1dcfdb099fd-bucket/index1/industries.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/79e0eebf-9221-4180-806b-e1dcfdb099fd-bucket/link1309/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7a74bbc2-d6c4-4023-b0e1-07f015dc3e06-bucket/authtryencd.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fa09544-72de-42d4-976f-3024cde6c69e-bucket/hostconfig1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fa09544-72de-42d4-976f-3024cde6c69e-bucket/hostconfig2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fa09544-72de-42d4-976f-3024cde6c69e-bucket/hostconfig3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fa09544-72de-42d4-976f-3024cde6c69e-bucket/hostconfig4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fa09544-72de-42d4-976f-3024cde6c69e-bucket/hostconfig4/index.html#orders@kohyo.nl"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fa09544-72de-42d4-976f-3024cde6c69e-bucket/hostconfig5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fa09544-72de-42d4-976f-3024cde6c69e-bucket/hostconfig6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fe52344-71e7-491a-957a-0808a3db62c4-bucket/idoj4td57.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/828f799f-ec93-49ee-80de-39133affb3ee-bucket/bcse2356/test1.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/843ddc8e-7812-425d-8786-ff9f92019e5d-bucket/2/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/85ba8a7f-904c-4990-b0c2-bead8d39509e-bucket/kf.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/874423c4-5870-4de7-a59f-232a02efc3d9-bucket/teri/industries.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8825716b-47be-4920-9c9e-1ac2704de473-bucket/indexx.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8a00ec1e-658c-4e29-9ea5-46121ba6e3a0-bucket/office365.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8b451ece-c4a5-48d8-841a-b574505a6de3-bucket/rfq11002092.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8bdfa202-61d7-4dcc-9a29-d6fe52c23e80-bucket/lankkk.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8dc99422-d4c8-42b5-85ba-33ace76b8a2c-bucket/emailserver4/index4.html#username@domainname.net"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8f2fa405-3ce4-4605-8deb-082636751e2b-bucket/webhost1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8f2fa405-3ce4-4605-8deb-082636751e2b-bucket/webhost2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8f2fa405-3ce4-4605-8deb-082636751e2b-bucket/webhost3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8f2fa405-3ce4-4605-8deb-082636751e2b-bucket/webhost4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8f2fa405-3ce4-4605-8deb-082636751e2b-bucket/webhost5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8f2fa405-3ce4-4605-8deb-082636751e2b-bucket/webhost6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9040ef9a-119e-4ce1-bf63-b09a71ed2f80-bucket/act12.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9040ef9a-119e-4ce1-bf63-b09a71ed2f80-bucket/act30.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9040ef9a-119e-4ce1-bf63-b09a71ed2f80-bucket/act45.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/90962a42-132b-4c83-a3a1-92e113f2c3cd-bucket/nddc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/91cee7ae-ad27-45c0-b553-63e08fe3a3e6-bucket/tny/test.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/91cee7ae-ad27-45c0-b553-63e08fe3a3e6-bucket/tny/test.html#user@domain.tld"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/92782670-8e61-4be0-b6f2-17ee79399a1e-bucket/p/index.htm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/964e1048-5b03-4dec-967c-466e7f3537ed-bucket/saved.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/97dc58b3-c8a8-4c6a-8a7a-8dcafe2abf80-bucket/dee.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/99e44e81-9b24-4834-88f5-02b58e83bacf-bucket/rfq11012.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9a2dd98e-1817-44a5-a4d0-501dd1898f7f-bucket/indeex.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9b058b1a-4344-48eb-b6d0-3553bbc51dcf-bucket/indeex.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9bec1394-a486-4409-9a50-4218a9d0bc14-bucket/vddfsdfdsa/cbfgffdsss/dr0pf1leupdatesabsnew.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9c61a082-b55d-407e-a39c-1051e08dc205-bucket/blessed2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9c61a082-b55d-407e-a39c-1051e08dc205-bucket/blessed3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9c61a082-b55d-407e-a39c-1051e08dc205-bucket/blessed4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9c61a082-b55d-407e-a39c-1051e08dc205-bucket/blessed5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9d7d1e58-5930-486a-b39d-31fbb3e857ea-bucket/excel.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9dd5041e-dc3c-43c6-befc-cdc72cf64192-bucket/vaccation/vaccation.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9deb5903-5150-491d-bdb8-cd4226f3a733-bucket/hitmail1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9deb5903-5150-491d-bdb8-cd4226f3a733-bucket/hitmail2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9deb5903-5150-491d-bdb8-cd4226f3a733-bucket/hitmail3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9deb5903-5150-491d-bdb8-cd4226f3a733-bucket/hitmail4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9deb5903-5150-491d-bdb8-cd4226f3a733-bucket/hitmail5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9deb5903-5150-491d-bdb8-cd4226f3a733-bucket/hitmail6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9e80b099-a27b-447c-8744-49e5712a9975-bucket/lemay/tim.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9f2d23ca-c5df-409f-8d0b-f2f040dca5cc-bucket/mncbx/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a0ce0e96-1821-4a6e-889c-d4b1e43eefc8-bucket/saved.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a11b8653-2408-4a21-a39d-5ad8dba1268b-bucket/pointsrdl/tomdex.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a13b5ba6-f9f7-4203-92e4-c62f329c654e-bucket/isjdomsnbckmkrezsxrdtpokjiuhygtfrdeswzxdswedrfdedrtfgyhujikominbuvyctxr/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a13b5ba6-f9f7-4203-92e4-c62f329c654e-bucket/isjdomsnbckmkrezsxrdtpokjiuhygtfrdeswzxdswedrfdedrtfgyhujikominbuvyctxr1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a13b5ba6-f9f7-4203-92e4-c62f329c654e-bucket/isjdomsnbckmkrezsxrdtpokjiuhygtfrdeswzxdswedrfdedrtfgyhujikominbuvyctxr2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a13b5ba6-f9f7-4203-92e4-c62f329c654e-bucket/isjdomsnbckmkrezsxrdtpokjiuhygtfrdeswzxdswedrfdedrtfgyhujikominbuvyctxr3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a13b5ba6-f9f7-4203-92e4-c62f329c654e-bucket/isjdomsnbckmkrezsxrdtpokjiuhygtfrdeswzxdswedrfdedrtfgyhujikominbuvyctxr5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a1f1764f-8d6c-4472-9af3-cb93bb5ab861-bucket/updatedomain21/index1.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a1f1764f-8d6c-4472-9af3-cb93bb5ab861-bucket/updatedomain22/index2.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a1f1764f-8d6c-4472-9af3-cb93bb5ab861-bucket/updatedomain23/index3.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a1f1764f-8d6c-4472-9af3-cb93bb5ab861-bucket/updatedomain24/index4.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a1f1764f-8d6c-4472-9af3-cb93bb5ab861-bucket/updatedomain24/index4.html#username@domainname.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a1f1764f-8d6c-4472-9af3-cb93bb5ab861-bucket/updatedomain25/index5.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a3ea993b-e46b-4262-86bb-e203b205619e-bucket/share7.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a400b283-41de-4205-a74f-2b4e0b7555ad-bucket/owa.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a550df2a-219d-4b56-9462-100403b29a5c-bucket/saved.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a9fb9e7f-5849-42b2-b797-36d34fd60ba7-bucket/kguygbiu/lank.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a9fb9e7f-5849-42b2-b797-36d34fd60ba7-bucket/lank.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/aa6a9059-1df0-4bd7-8fb9-bd7e76ea9f61-bucket/htm.htm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ade20f9c-c4f5-4050-a6aa-56c91853236a-bucket/dddropbobok/dr0pf1leupdatesabsnew.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ae4bed1f-ba64-4ed7-9572-486fdbe5f910-bucket/quats/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/aeb1625f-38ba-4374-ad3a-878dcba7ec19-bucket/columbiacountrypdf/scanned%20storage.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat1/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat10/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat10/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat11/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat11/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat12/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat12/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat13/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat13/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat14/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat14/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat15/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat15/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat2/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat3/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat4/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat5/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat6/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat7/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat7/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat8/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat8/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat9/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat9/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b6c979c7-4be6-4eb4-accc-9cc55f1d75d0-bucket/sharepoint%20weblogin.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b71b9137-cd44-48b4-93d0-5223010560ee-bucket/adobe/doc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b937d62c-b576-430f-b4be-119cfe7a64bb-bucket/s39b60d3ff90c4e781b8.html#test@alam.edu.my"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bbb53b82-e723-4336-a344-fe30b5a2f097-bucket/fancy1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bbb53b82-e723-4336-a344-fe30b5a2f097-bucket/fancy2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bbb53b82-e723-4336-a344-fe30b5a2f097-bucket/fancy3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bbb53b82-e723-4336-a344-fe30b5a2f097-bucket/fancy4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bbb53b82-e723-4336-a344-fe30b5a2f097-bucket/fancy5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bc904cf2-8abe-4e8a-ad5d-8774596d97a0-bucket/inshawesdrctvybuniexscdrfxeszxrctvybuniominubyvtcrxexrctcrxectvytcxrctvyctxresdrftgyuhjik3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bc904cf2-8abe-4e8a-ad5d-8774596d97a0-bucket/inshawesdrctvybuniexscdrfxeszxrctvybuniominubyvtcrxexrctcrxectvytcxrctvyctxresdrftgyuhjik4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c0b487e2-23f8-416d-bbed-b9f9e9ce2cbd-bucket/aeroportslaregi0ndox/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c14d401f-b22b-46e6-9e64-b9e6d663f172-bucket/vbnm/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c1684a2d-d8d1-4ef1-8d82-b9b6356e2318-bucket/vandik1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c252a894-34a9-45a0-84b3-9edfe2b5dfaf-bucket/rfq11012.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c2cb4ebf-e864-40e7-b152-eff2663d3fc3-bucket/blosuom1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c2cb4ebf-e864-40e7-b152-eff2663d3fc3-bucket/blosuom2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c2cb4ebf-e864-40e7-b152-eff2663d3fc3-bucket/blosuom3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c2cb4ebf-e864-40e7-b152-eff2663d3fc3-bucket/blosuom5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c2ff9cd3-0839-4c85-b8d1-fd29cac483fb-bucket/44.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c4ecb581-c14c-4528-a005-0ca9b227f956-bucket/mailupdate9/index.html#test@test.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c4ecb581-c14c-4528-a005-0ca9b227f956-bucket/mailupdate9/index.html#username@domainname.co.uk"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c7cdfa4c-71b9-4ed2-bc0b-d887cb80f0a4-bucket/g2r/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cbffd7e9-e873-4c72-8f7b-69ce9161e733-bucket/doc/file.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cd58cb52-dd4e-4dcc-a2ac-54d4b76d6c9f-bucket/rfq11012.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cd67645e-8bb5-408e-baa5-0a38212c8e58-bucket/axis%20mechanical%20inc/secure-pdf.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d024ca4e-b6ac-41d7-a224-193b035fc1cf-bucket/ppr/index.htm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d07abc36-1bdf-4400-820f-9f9679bc8d11-bucket/invoice/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d1036811-cb11-47a4-a859-470e4ed5f6fa-bucket/microsoftlogin-data/micrsoftonllline.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d1702318-c031-4e3d-8bb8-7e722d73418b-bucket/types1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d1702318-c031-4e3d-8bb8-7e722d73418b-bucket/types2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d1702318-c031-4e3d-8bb8-7e722d73418b-bucket/types4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d1702318-c031-4e3d-8bb8-7e722d73418b-bucket/types5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d1ae1249-5ae7-49ae-b4f9-4f16b530e070-bucket/rfq11012.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d1dc6e73-7931-42ef-aaa2-1f5d61d4bb0a-bucket/owa/02384972384623453672.htm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d474ca09-59f9-4e4e-95bb-3853d367cb3c-bucket/none/milkr%20(1).html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d6ba5f32-1c9e-44ab-bfa6-27a100306508-bucket/msh/shrm.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d6ba5f32-1c9e-44ab-bfa6-27a100306508-bucket/shrm/shrm.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d9faca97-3ef4-4f19-bdb7-744644982c59-bucket/webswindle1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d9faca97-3ef4-4f19-bdb7-744644982c59-bucket/webswindle2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d9faca97-3ef4-4f19-bdb7-744644982c59-bucket/webswindle3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d9faca97-3ef4-4f19-bdb7-744644982c59-bucket/webswindle4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d9faca97-3ef4-4f19-bdb7-744644982c59-bucket/webswindle5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d9faca97-3ef4-4f19-bdb7-744644982c59-bucket/webswindle6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dbbba225-63e2-46ea-8637-c3a8a7bff992-bucket/jeff.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dc13decc-2169-43e3-81f1-e1c465fec279-bucket/singer1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dc13decc-2169-43e3-81f1-e1c465fec279-bucket/singer2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dc13decc-2169-43e3-81f1-e1c465fec279-bucket/singer3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dc13decc-2169-43e3-81f1-e1c465fec279-bucket/singer4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dd0fbd66-95b6-47a9-9648-0df7c81ffc5f-bucket/redx.html#elektra@debeij.nl"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/de106e12-afc7-47ed-a45e-172440798261-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/decca190-a63b-4b0e-9ab0-afb6c79bae04-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/decca190-a63b-4b0e-9ab0-afb6c79bae04-bucket/update%20/webalizer2.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e09f3ef1-7bac-486e-99b2-12dd553973f8-bucket/00/langs.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3dd30bb-a121-4492-aaed-440a81a72c07-bucket/verifymail1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3dd30bb-a121-4492-aaed-440a81a72c07-bucket/verifymail2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3dd30bb-a121-4492-aaed-440a81a72c07-bucket/verifymail3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3dd30bb-a121-4492-aaed-440a81a72c07-bucket/verifymail4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3dd30bb-a121-4492-aaed-440a81a72c07-bucket/verifymail5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3dd30bb-a121-4492-aaed-440a81a72c07-bucket/verifymail6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3f21bd5-7ed2-4b34-8327-735a0b83032e-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e775e9e9-7b55-40c8-a6a0-fc0adb899459-bucket/fileofc%20(1).html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e7e8af67-4621-481e-bffe-1bb1fc29b96f-bucket/benny3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e89163cb-39d5-41dd-a32d-1338546aa873-bucket/webhub1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e89163cb-39d5-41dd-a32d-1338546aa873-bucket/webhub2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e89163cb-39d5-41dd-a32d-1338546aa873-bucket/webhub3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e89163cb-39d5-41dd-a32d-1338546aa873-bucket/webhub4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e89163cb-39d5-41dd-a32d-1338546aa873-bucket/webhub5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e89163cb-39d5-41dd-a32d-1338546aa873-bucket/webhub6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eaec3e2b-c02d-4192-b10c-b8c8a9318a1f-bucket/02/index(6).html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ebfd41a2-fd8b-4507-8e55-8cef921acd7b-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ec16a01a-a84f-42da-bb4e-43675e3533bb-bucket/docu/drop.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/edd36ae3-3254-4149-83ce-17be188be9e0-bucket/wenutritioncom4/index.html#user@example.org"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eed55a84-55f2-499f-a1bb-6e1bf7cfb87c-bucket/03/milk.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ef692558-db56-4b63-89e6-ebb8162f59f2-bucket/approver5/approver-email.html#xx@xx.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/efc10aba-c569-426e-b4a9-cdaccd2a84f4-bucket/se787tw578w/indestri.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f1e747e4-2191-4882-bc0f-5f96e3778913-bucket/configresolve3/index.html#info@mup.cz"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f65409f0-fc6e-416e-8256-76487a2c8ead-bucket/pric/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f7a40b87-4ece-4415-bd00-eeb6f57ee5ae-bucket/swamp1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f7a40b87-4ece-4415-bd00-eeb6f57ee5ae-bucket/swamp2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f7a40b87-4ece-4415-bd00-eeb6f57ee5ae-bucket/swamp4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f7a40b87-4ece-4415-bd00-eeb6f57ee5ae-bucket/swamp5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f88638fd-eff1-4077-91b5-49b7879f3a6e-bucket/nee-portaladminstrative-service-recoveryverification/secures.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec1/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec10/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec10/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec11/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec11/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec12/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec12/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec13/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec13/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec14/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec14/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec15/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec15/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec2/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec3/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec4/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec5/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec6/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec7/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec7/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec8/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec8/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec9/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec9/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fa7d3aaf-eeb8-4e02-8d10-6c34571a5548-bucket/em-accountshosting2/index4.html#roger.meier@4synergy.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fb5fef6d-0fbc-4165-8e76-6acbfdecb43c-bucket/robin/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fd178da9-a7ff-446a-a1af-a84d061c4988-bucket/nova/msqrl.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fd178da9-a7ff-446a-a1af-a84d061c4988-bucket/nova/msqrl.html#j.jongkind@wahlen-jongkind.nl"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fdbe15cb-8405-4530-937e-33356dca6c19-bucket/02/intell.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fed7fce4-adbc-499d-985e-9c3ea4070ada-bucket/ggenn.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/api/dhl-express/postdhl/ch/dhl/"; http_uri; nocase; content:"streamlive.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200063324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:x:/r/personal/adrian_ramos_superpark_com_hk/_layouts/15/wopiframe.aspx?guestaccesstoken=vofjngnui%2fslbameorlq62qlg8mcdnpo1dizu6i%2bc1m%3d&amp\;docid=1_124bbb2f682ca4c7daba6cec6ee34dfb9&amp\;wdformid=%7ba85c8abe%2d68be%2d43dd%2d91f3%2db397386186be%7d&amp\;action=formsubmit"; http_uri; nocase; content:"superpark-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qbz5jjm9a"; http_uri; nocase; content:"supersurvey.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/millennium_management_llc_e1780935.html"; http_uri; nocase; content:"supplierss.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"support-chase-help.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/login.php"; http_uri; nocase; content:"support-sfr-client.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckbdk?jfqcs"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200063330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckbdk?tnjem"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200063331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckbdk?wtkpo"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200063332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckbgr?zkvync"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200063333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckbih?gqdss"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200063334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckbjh?jupzn"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200063335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckbjh?unhiep"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200063336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckmuz?erxji"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200063337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckmuz?nngxs"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200063338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckmuz?sesxxad"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200063339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckmuz?xfcgxy"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200063340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/zs/ffbunc"; http_uri; nocase; content:"survey.zohopublic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/608bca7586919c70a2066ef7"; http_uri; nocase; content:"surveyheart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/60fff0e60888042acd81382f"; http_uri; nocase; content:"surveyheart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/621b14f5c65e8f2fdc0ec20c"; http_uri; nocase; content:"surveyheart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/622b8c8ed898226fb3ed9404"; http_uri; nocase; content:"surveyheart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/6255d8c288a46f5efbbc781c"; http_uri; nocase; content:"surveyheart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/.cha.htm?feeccf00ec7600bcf71c"; http_uri; nocase; content:"szsmartest.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5wzcfrnmij"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7nvaa7gshn?trackingid=gvnj958o&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7nvaa7gshn?trackingid=iu65vdbt&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8kuqorubt4?signature=newsletter&amp\;trackingid=qj0y6ihhlutkjd3fwk0gxurjedhgfoe1"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9ooxxstzmb?amp=1?trackingid=aeqsrw06&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/almyiprdy1"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fy2lasfqae?trackingid=4zhypwnm&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fy2lasfqae?trackingid=sficgo6n&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fy2lasfqae?trackingid=soiybkrq&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hklifuye7q?signature=newsletter&amp\;amp\;trackingid=v2izthgeggs2ontblne93wojyanti2dz"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ikw474csk2"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/j6la6tjeil?signature=newsletter&amp\;trackingid=ikxy5w2prwakarovqzyjf5lsipf1elqt"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jcyrtlrlqf?trackingid=dikwswiz&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k78cpcjb9y?https://webmail.spectrum.net/mail"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lw5kd2y1yg"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ndr3euzftx"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nnracfdpqz?v=kpdqhnid-d2?trackingid=ub8f4520&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nnracfdpqz?v=leovdeob-hu?trackingid=xplu2ju0&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nnracfdpqz?v=vrllwvpk-78?trackingid=cnr8reb5&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nnracfdpqz?v=xlp6ftab-dk?trackingid=86sfocz4&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nnracfdpqz?v=xth3uugp-ly?trackingid=3xaexyou&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/oc8dgzpvag?type=news_sduwftmbmgintfa&amp\;page_id=141"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pw7pa4xm5s"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rqcv9sn2pt"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tlemnhdfgw"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uqjhuzcwqg?trackingid=xqyal3bj&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/z3gsth5xgs"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200063374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3odd"; http_uri; nocase; content:"t.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200063375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/beum"; http_uri; nocase; content:"t.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200063376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qzb8?hvfq"; http_uri; nocase; content:"t.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200063377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qzb8?uovb"; http_uri; nocase; content:"t.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200063378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/zrir"; http_uri; nocase; content:"t.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200063379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/+pg0whvxoqzgzmdg0"; http_uri; nocase; content:"t.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200063380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/franklinscott23"; http_uri; nocase; content:"t.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200063381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fxcryptotradegrouphelp"; http_uri; nocase; content:"t.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200063382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/irs_agency"; http_uri; nocase; content:"t.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200063383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/irsagencies"; http_uri; nocase; content:"t.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200063384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/click_pixel?et=c&amp\;ago=212&amp\;ao=546&amp\;aca=26737887&amp\;si=7192763&amp\;ci=161117887&amp\;pi=317760010&amp\;ad=512366295&amp\;sv1=[keyword_id]&amp\;advt=4470646&amp\;chnl=-7&amp\;vndr=115&amp\;sz=6585&amp\;u=red=https://0g09rebqe8ms76om9oaq8oemd1t066ke0j725els0lpmpclkoh54heg.siasky.net/#test@mmhe.com.my"; http_uri; nocase; content:"t.myvisualiq.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200063385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tt/e2272313295849e1c619639a76f215659913d352/65c305586540d3917cefcff599131525/8224260473aa015a9ef229ec61963929/meqttm.com#dtovar@todo1.com"; http_uri; nocase; content:"t.yesware.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yahoooooooo"; http_uri; nocase; content:"taplink.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200063387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/files/system32/procesosdeseguridadhb/170.51.165.16679791/agregar/telefono/contacto/logonoperacionservlet.html"; http_uri; nocase; content:"tecsuport.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200063388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2021/03/blog-post_48.html"; http_uri; nocase; content:"telenorkandklimsupoort.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?shiny"; http_uri; nocase; content:"telhanorte-90.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/dhl/dhl_topscript/cmd-login=8e624428269b1e296f49085bd6b42d28/"; http_uri; nocase; content:"tggworld.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inter/internode.html"; http_uri; nocase; content:"thewarnersbayvet.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200063392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5cgfd"; http_uri; nocase; content:"tiny.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200063393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/owes09"; http_uri; nocase; content:"tiny.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200063394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ing6588"; http_uri; nocase; content:"tiny.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200063395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ks74cs4"; http_uri; nocase; content:"tiny.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200063396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4hbvuu8c"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/accessobancabper"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bancabper"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bperaccessoweb"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bperbancaweb"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/docu1fax"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-71vxj8jf"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-rg4nexv"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-1raku3v"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-dkynk8j2t"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-jgwqcwfnjv"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-mhe0ohp9"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-qqp3vta2"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-rtkhnnwu"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-vbhhyp"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-xixqr6i9b"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-x1bbcdq7ey"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form-i1tknpeygn"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form-xlpgrzzs"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/issues-sr6ibhmquw"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/issueslagv3a"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/issuestygtxz"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-4hg3l1btr"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-dqd86ubhbq"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-flkzbx1s3f"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-hijw94ctlf"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-lfxes1fttl"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-odmnerxjsg"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-osgfshdnaa"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-srr085p"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-stowq7oxj"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-t2zgxdx9"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-umnwdly"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-y6ftsfwn"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-yafbicqxn"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yc24jz87"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yettf66x"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tlc"; http_uri; nocase; content:"tny.im"; content:"Host"; http_header; classtype:attempted-recon; sid:200063434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/h/v6/link-track/1.0/1612678003989072-e5f6d8cc-499b-ea4f-85f1-8b23ad935661/1612677988/2f5895837f8d3f0a667c6b92ad41f652/8af273ac431e289838c8bf7c490185f3/3fe2530ffaa60580b73b9eec6af02f4d?redirect_uri=http://amazon.com"; http_uri; nocase; content:"tr.cloudmagic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/h/v6/link-track/1.0/1614590779401122-8e06125c-4b23-d643-3068-601cab9bec04/1614590763/2f5895837f8d3f0a667c6b92ad41f652/31367888a66bf6f98973a200c83075bb/3fe2530ffaa60580b73b9eec6af02f4d?redirect_uri=http://amazon.com"; http_uri; nocase; content:"tr.cloudmagic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c/?bn=35405429\;cpdir=https://tmmny.csb.app/.wewrewew.ahr0chm6ly9pbnzlc3rpbmdpbmdvzc5vcmcvqvbjmjq3.yw1izxiuzml0dg9uqhnwyxjrlmnvlm56"; http_uri; nocase; content:"track.adform.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200063437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5022136/c?p=x5oidfhz2ouxhklaeegsdp9s1gfirlzjghcqduq9hhg14modcqwps7jwscfrdgzmzdelisqni_uf_ote8n4hr1lfku8fmxwxxrlkbis-61qncxwmoudp0aixd8q2rizn6crwltqa4h03cpp0xn_mtdnq9uswzoylgk1aevcq8fk="; http_uri; nocase; content:"track.smtpsendemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/webapp/tribratanews/public/js/hughesnet.com/index.php"; http_uri; nocase; content:"tribratanewsbondowoso.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ls/click?upn=rh-2bf9hqggd83zvr8-2f2urpq9jza4nfyepanu7d3q3phc5fuhcmko-2bdnkpb77-2frn0jksb4_12auc2qfc-2fmvanj9w5gz1niyn6w81nfyizixxcjyohcdjetmz8z7ozsg5qrzrqqfo70kk0rjxowq28q5nzx71p4rno1y2borqqazxmt0955ioulj3hotvbzkpo8pa09ilfa4l4xjki0vdirect7fh-2btqojn5nn-2bsvj56b8oj6ytisepl-2fyndoytlygbqfjcsnzj7xrxpcpc2y33v-2brcfmdaa-2fuzaljxshizppw79wtya017swhsi773accxnrksgojupnndhln5rwkqefr00pg-3d-3d"; http_uri; nocase; content:"trk.klclick3.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ls/click?upn=vj3dadlrp-2fcfi22cxv5slmj9bs27v4ur9e-2f6aekkiuju7zruatjxol6lgt5xi6fx6lhwu7l9t0cxeulddiovrbyfpra1wztkgpi63kwkws-2bmvhmxfgmb6yn7jskx-2fu4r03dky7iafgb-2fta6hwqby63ucxfknnix2s1jtelfxd3wiwwlifn0vjgeal5ujbmupx8bbjcxvchr1ok8xfrqfnmy836ctsoh-2flt3d7uovnjooazs9eprx4wedfnmn7-2ffobhap4tt4pl-2f8q2poovn5cgshg-2fbbipi0gmepwr3skurvpjwgiyerch1vtr9yyrov5bbgjn-2fvhfiffsnaqi5bca-3d-3dkqpr_0ivmhd7nsoe2up5tze3op8d-2fsn3ohure6d19gi8qjbwosimpdtamk7y8urnfbq0eurrturkgyz8ptfq84s0oghdjaey4eqygfme-2fornmqugxkvuhwavsrvpuyd6j3ehclftk-2fmhytlzdz4wv4ecss4tpqsttkgejqscggvgnl9s16ulwcz4ssvrqiuim0snvj2i6p8dzv6clywsguhbw5yjht4b08ursgrgxp0j7nmkuf93odmq9xwbxnuqp-2bry65pnu-2frpphtuvgjsa8tolngsbb8jnsy6mjxkfnkxn672ryzlksl-2bcvphralufouhwimybzdacvpo13oxjwigqqcoyv2yfewxdqtphaydrskcereezuvegylv3m76xouvyyowqnmkdh13-2bfz01-2bqnsuw-3d-3d#amfwzxjlekbiyw5jb29wlmnvbq=="; http_uri; nocase; content:"trk.klclick3.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/81ad8277-2641-4559-9924-3226fff1aeb8?lm_sub=4183&lm_list=gmail_cleaned&lm_shoot_mode=manual&lm_version=8201&lm_id=mlacys97%40gmail.com&lm_age=22%2f08%2f1964"; http_uri; nocase; content:"tuntine-resport.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b9sm"; http_uri; nocase; content:"twixar.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200063443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hcsm"; http_uri; nocase; content:"twixar.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200063444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/_sglha"; http_uri; nocase; content:"u.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200063445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cdxnha"; http_uri; nocase; content:"u.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200063446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hdfkha"; http_uri; nocase; content:"u.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200063447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pqfiha?confirm.recovery"; http_uri; nocase; content:"u.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200063448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qgxnha"; http_uri; nocase; content:"u.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200063449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pbi_pbi1151/login/remote/071108407/6"; http_uri; nocase; content:"ucbonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:w:/g/personal/jmlee_ucmo_edu/ey4vifgt_7nfmz9xrsc5lpcbyiu2dkrhyz1vcu3pcml_la?e=4%3advzg7b&amp\;at=9"; http_uri; nocase; content:"ucmo0-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2jtcaszcsaza/click-here-to-verify-your-email"; http_uri; nocase; content:"unigeol.quip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uploads/user/05f89058-061c-48b2-856d-a88922dc294e/5r8g-index.html"; http_uri; nocase; content:"uploads.codesandbox.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200063453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/000"; http_uri; nocase; content:"url.dscdut.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mail2022"; http_uri; nocase; content:"url.dscdut.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nudi"; http_uri; nocase; content:"url.dscdut.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?byzfzh01a8agnrfkn2qmyujcvyce3awstvjvfvza8k7z-mi7uoyekfwkp0v6uia5gksaqub2jvcrtkxzypflbtm3dvnmhilt5onpcy2165mweqkphha5rbmbyvrk68yts"; http_uri; nocase; content:"url.emailprotection.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200063457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/result/d20ea0a6-903f-46c2-9377-ac533812b1ad/"; http_uri; nocase; content:"urlscan.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200063458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3m_r1"; http_uri; nocase; content:"urly.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200063459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3m_y1"; http_uri; nocase; content:"urly.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200063460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic37"; http_uri; nocase; content:"urlz.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200063461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/igvb?/page-help-support"; http_uri; nocase; content:"urlz.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200063462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/igvj?/page-help-support"; http_uri; nocase; content:"urlz.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200063463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/iqe0"; http_uri; nocase; content:"urlz.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200063464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/au4zs"; http_uri; nocase; content:"urlzs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dbgei"; http_uri; nocase; content:"urlzs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/g8zxv"; http_uri; nocase; content:"urlzs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lm53"; http_uri; nocase; content:"usnd.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200063468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2gfq?facebook_secu%c9%beity_report="; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200063469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2nitw?security-page?security.id"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200063470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/abqe"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200063471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bbjiy?team_report_page"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200063472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d0bv?confirmation_facebook_report"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200063473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e4ea?team_report_page"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200063474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gsig?confirmation_facebook_report"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200063475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kvisr?confirmation_facebook_report"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200063476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kvjh"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200063477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/midb?confirmation_facebook_report"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200063478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n5j4d"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200063479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/s7zj?confirmation_facebook_report"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200063480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vymxy?confirmation_facebook_report"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200063481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wdhoz?security-page?security.id"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200063482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xonp?confirmation_facebook_report"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200063483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/verification/"; http_uri; nocase; content:"vbttechnosoft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiceeesacvciracrsior.avisievseaaciccovsinaoeosnmer.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.lzpytu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.lzpytu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.lzpytu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.lzpytu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.lzpytu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.lzpytu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/689734/3489345346/"; http_uri; nocase; content:"verifyservices-contact.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaaveesevcesei.vivcacsveersaoir.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaaveesevcesei.vivcacsveersaoir.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaaveesevcesei.vivcacsveersaoir.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaaveesevcesei.vivcacsveersaoir.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaaveesevcesei.vivcacsveersaoir.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaeveesavceei.vivcsvcesairaser.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaeveesavceei.vivcsvcesairaser.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaeveesavceei.vivcsvcesairaser.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaeveesavceei.vivcsvcesairaser.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaeveesavceei.vivcsvcesairaser.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaeveesvcceei.vivacscversrai.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaeveesvcceei.vivacscversrai.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaeveesvcceei.vivacscversrai.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaeveesvcceei.vivacscversrai.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaeveesvcceei.vivacscversrai.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaavceesevcesei.visvacsveerasoir.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaavceesevcesei.visvacsveerasoir.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaavceesevcesei.visvacsveerasoir.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaavceesevcesei.visvacsveerasoir.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaavceesevcesei.visvacsveerasoir.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaavseevceei.vivcsvescair.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaavseevceei.vivcsvescair.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaavseevceei.vivcsvescair.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaavseevceei.vivcsvescair.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaavseevceei.vivcsvescair.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaeavesvcsceei.viavacesvoerrcsaias.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaeavesvcsceei.viavacesvoerrcsaias.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaeavesvcsceei.viavacesvoerrcsaias.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200063681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaeavesvcsceei.viavacesvoerrcsaias.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavasevcesei.vivcasveesacoiras.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavasevcesei.vivcasveesacoiras.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavasevcesei.vivcasveesacoiras.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200063687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavasevcesei.vivcasveesacoiras.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200063688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavasevcesei.vivcasveesacoiras.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavasevcesei.vivcasveesacoiras.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavasevcesei.vivcasveesacoiras.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavcseevceei.visvsveacsir.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavcseevceei.visvsveacsir.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavcseevceei.visvsveacsir.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavcseevceei.visvsveacsir.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavcseevceei.visvsveacsir.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveceesavceei.visvsvceasiraser.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveceesavceei.visvsvceasiraser.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveceesavceei.visvsvceasiraser.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveceesavceei.visvsvceasiraser.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveceesavceei.visvsvceasiraser.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveceesvcceei.visavscverarsi.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveceesvcceei.visavscverarsi.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveceesvcceei.visavscverarsi.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveceesvcceei.visavscverarsi.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveceesvcceei.visavscverarsi.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveseevacei.vivsvesicaserr.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveseevacei.vivsvesicaserr.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveseevacei.vivsvesicaserr.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveseevacei.vivsvesicaserr.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveseevacei.vivsvesicaserr.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavsveecei.vivsvesicr.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavsveecei.vivsvesicr.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavsveecei.vivsvesicr.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavsveecei.vivsvesicr.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavsveecei.vivsvesicr.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viacsevcesei.visvasvceeaso.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viacsevcesei.visvasvceeaso.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viacsevcesei.visvasvceeaso.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viacsevcesei.visvasvceeaso.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viacsevcesei.visvasvceeaso.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viacveaeaevcecrei.viavcrrsvcroieai.jwfbzu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaecesvcsceei.viasavesvcoerra.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaecesvcsceei.viasavesvcoerra.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaecesvcsceei.viasavesvcoerra.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaecesvcsceei.viasavesvcoerra.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaecesvcsceei.viasavesvcoerra.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevasvcceei.vivacsvercsaias.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevasvcceei.vivacsvercsaias.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevasvcceei.vivacsvercsaias.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200063730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevasvcceei.vivacsvercsaias.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200063731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevasvcceei.vivacsvercsaias.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevasvcceei.vivacsvercsaias.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevasvcceei.vivacsvercsaias.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevesvcsceei.viavacesvcoerrs.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevesvcsceei.viavacesvcoerrs.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevesvcsceei.viavacesvcoerrs.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200063737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevesvcsceei.viavacesvcoerrs.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200063738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevesvcsceei.viavacesvcoerrs.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevesvcsceei.viavacesvcoerrs.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevesvcsceei.viavacesvcoerrs.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2021/03/blog-post.html"; http_uri; nocase; content:"viamobte.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200063742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viasecviioenrem.vsosirvsismscvoiei.fmstks.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200063743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viasecviioenrem.vsosirvsismscvoiei.piokus.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200063744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viaseescviioenrem.vsosirvsismsivi.fmstks.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200063745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.fmstks.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200063746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.fmstks.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200063747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viaseesxcviioerscznrem.vsosieovsismsivi.fmstks.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200063748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.fmstks.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200063749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.fmstks.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200063750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavcasevcesei.visvasveeascoiras.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavcasevcesei.visvasveeascoiras.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavcasevcesei.visvasveeascoiras.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200063753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavcasevcesei.visvasveeascoiras.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavcasevcesei.visvasveeascoiras.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavcasevcesei.visvasveeascoiras.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaveacesvcsceei.viasavesvoerrcasias.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaveacesvcsceei.viasavesvoerrcasias.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaveacesvcsceei.viasavesvoerrcasias.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200063759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaveacesvcsceei.viasavesvoerrcasias.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaveacesvcsceei.viasavesvoerrcasias.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaveacesvcsceei.viasavesvoerrcasias.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavsavceei.vivcsvecsaias.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavsavceei.vivcsvecsaias.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavsavceei.vivcsvecsaias.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200063765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavsavceei.vivcsvecsaias.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavsavceei.vivcsvecsaias.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavsavceei.vivcsvecsaias.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vicvcsecresseevei.cveversavesi.ptpcdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vicvcsecresseieececievirveiaaevesi.wdczpu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vicvcsecresseieececievirveiaaevesi.zxpdbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vicvcsecresseieveic.eivresiavesi.mjijyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vicvcsecresseieveic.eivresiavesi.wetot.company"; content:"Host"; http_header; classtype:attempted-recon; sid:200063773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vicvcsecseeecei.vivraevesi.zxpdbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vicvssecceivei.vivsrivesi.wetot.company"; content:"Host"; http_header; classtype:attempted-recon; sid:200063775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vicvsseccevei.vivseresi.mjijyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vicvsseccevei.vivseresi.zxpdbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vicvssecrecsevei.vciesersvesi.ppcihu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieanioinneiure.visorevsirnnermmvi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieanioinoeircenure.visorronecsmsenercmsvi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieanioinreicenure.visorerencssmxarenercmsvi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieanioinreie.visorcvsienrrnmmvi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieasecivioenre.vsosirvsivmenscevoiei.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieaseeisviioenem.vsosirvvenismesivi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieniocineei.visorcsievrcrnnvxmrvi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieoesrinceisnv.vsoersvrornnirmsvi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieoesrinseinv.vsoersvioerinrmsvi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieoinviaesnsiea.vocasccvoenucveoiei.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieoinvisaoesnsera.vocavscncosuenvi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/authorize/1663678320865003"; http_uri; nocase; content:"vinted-pl-gj32d.kuantu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/authorize/1662975258698217"; http_uri; nocase; content:"vinted-pl-gj32d.uttu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vioinvaoesnsiera.vocasccosucvoiei.fmstks.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200063808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vioinvaoesnsiera.vocasccosucvoiei.piokus.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200063809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vioinvssaoesnsiera.vocasccosunvi.fmstks.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200063810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.fmstks.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200063811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.fmstks.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200063812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.piokus.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200063813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.fmstks.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200063814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.piokus.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200063815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visacsoiceesiver.c.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visacsoiceesiver.c.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visacsoiesiver.o.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visacsoiesiver.o.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visacsvoiceeesiver.cea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visacsvoiceeesiver.cea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visacsvoieesiver.oea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visacsvoieesiver.oea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visaevcscoeissiver.c.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visaevcscoeissiver.c.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visaevcsoissiver.o.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visaevcsoissiver.o.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visaevescseiver.c.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visaevescseiver.c.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visaevessiver.a.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visaevessiver.a.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visaevvcsceoeissiver.cea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visaevvcsceoeissiver.cea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visaevvcsoeissiver.oea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visaevvcsoeissiver.oea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visaevvesceseiver.cea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visaevvesceseiver.cea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visaevvesseiver.aea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visaevvesseiver.aea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visavesicveer.c.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visavesicveer.c.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visavesiver.a.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visavesiver.a.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visavevsiceveer.cea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visavevsiceveer.cea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visavevsiveer.aea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visavevsiveer.aea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visecai.vscsaeiso.mzztru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viseioscai.vscsaieeicso.uqmzwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viseoscai.vscsaeeicso.uqmzwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvevaccvncvsa.viveseevcavrenvci.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvevaccvncvsa.viveseevcavrenvci.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvevaccvncvsa.viveseevcavrenvci.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvevcvcnvsa.vivsvcveeenavci.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvevcvcnvsa.vivsvcveeenavci.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvssavccacsevi.vieveeevacrvnvsa.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvssavccacsevi.vieveeevacrvnvsa.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvssavccacsevi.vieveeevacrvnvsa.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvssvccasevi.vivevceevnavsa.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvssvccasevi.vivevceevnavsa.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvssvccasevi.vivevceevnavsa.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvssvcsrccasevi.vivevaseroceevnavsa.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvssvcsrccasevi.vivevaseroceevnavsa.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvssvcsrccasevi.vivevaseroceevnavsa.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvsvaccvecnvci.vieveecaaarsenvs.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvsvaccvecnvci.vieveecaaarsenvs.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvsvaccvecnvci.vieveecaaarsenvs.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvsvaccvecnvci.vieveecaaarsenvs.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvsvcvcenvci.vivcaaeeseanvs.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvsvcvcenvci.vivcaaeeseanvs.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvsvcvcenvci.vivcaaeeseanvs.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivaiesvccearsio.avisevsaccovosinorri.fehvvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcavaesevai.sa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcavaesevai.sa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcavaesevai.sa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcaveaecsevai.saaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcaveaecsevai.saaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcaveaecsevai.saaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcaveescvai.saa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcaveescvai.saa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcaveescvai.saa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcavesvai.s.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcavesvai.s.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcavesvai.s.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivceaevacreasecvai.saoaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivceaevacreasecvai.saoaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivceaevacreasecvai.saoaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivceaevecrsavaci.soaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivceaevecrsavaci.soaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivceaevecrsavaci.soaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivceavareasecvai.sao.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivceavareasecvai.sao.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivceavareasecvai.sao.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivceaversavaci.so.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivceaversavaci.so.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivceaversavaci.so.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivcsavceei.visvsvecasias.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivcsavceei.visvsvecasias.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivcsavceei.visvsvecasias.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200063915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivcsavceei.visvsvecasias.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200063916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivcsavceei.visvsvecasias.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivcsavceei.visvsvecasias.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivcsavceei.visvsvecasias.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcsreiseecei.cvrieveiaaevesi.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcsreisevei.vcirveesiavesi.jwfbzu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcssecievei.vivesiesi.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcssecreesecei.vcieeaaevesi.exmrhu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcssecreesecei.vcieeaaevesi.zxpdbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcssecreisevei.vcieesiavesi.exmrhu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcssecreisevei.vcieesiavesi.wetot.company"; content:"Host"; http_header; classtype:attempted-recon; sid:200063926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivecasvcceei.visavsvercasias.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivecasvcceei.visavsvercasias.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivecasvcceei.visavsvercasias.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200063929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivecasvcceei.visavsvercasias.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivecasvcceei.visavsvercasias.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivecasvcceei.visavsvercasias.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viveevaarvasecvsi.eao.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viveevaarvasecvsi.eao.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viveevaarvasecvsi.eao.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viveevavrsavsci.eo.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viveevavrsavsci.eo.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viveevavrsavsci.eo.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viveeveaacrvasecvsi.eaoaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viveeveaacrvasecvsi.eaoaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viveeveaacrvasecvsi.eaoaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viveeveavcrsavsci.eoaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viveeveavcrsavsci.eoaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viveeveavcrsavsci.eoaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevaavsevsi.ea.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevaavsevsi.ea.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevaavsevsi.ea.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevacvncvsa.vivesvcvrenvci.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevacvncvsa.vivesvcvrenvci.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevaeavcsevsi.eaaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevaeavcsevsi.eaaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevaeavcsevsi.eaaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevaevscvsi.eaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevaevscvsi.eaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevaevscvsi.eaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevavsvsi.e.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevavsvsi.e.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevavsvsi.e.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevcvcsrnvsa.vivsvcveaseronvci.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevcvcsrnvsa.vivsvcveaseronvci.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevcvcsrnvsa.vivsvcveaseronvci.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevcvnvsa.vivsvcvenvci.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevcvnvsa.vivsvcvenvci.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsacsocieesesia.c.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsacsocieesesia.c.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsacsoiesesia.o.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsacsoiesesia.o.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsacvsoceieesesia.cea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsacvsoceieesesia.cea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsacvsoieesesia.oea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsacvsoieesesia.oea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsavesceesia.c.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsavesceesia.c.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsavesesia.a.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsavesesia.a.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsavvesceeesia.cea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsavvesceeesia.cea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsavveseesia.aea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsavveseesia.aea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivscreisveci.vcirveseiaveesi.retdou.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivscsecreisveci.vcieseiaveesi.exmrhu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivscsecreisvei.vicveesivesi.wetot.company"; content:"Host"; http_header; classtype:attempted-recon; sid:200063985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivscsecrevseci.vicveeaveesi.zxpdbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivseavccseoissesia.c.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivseavccseoissesia.c.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivseavcsoissesia.o.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivseavcsoissesia.o.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivseavecsesesia.c.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivseavecsesesia.c.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivseavessesia.a.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivseavessesia.a.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivseavvcceseoissesia.cea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivseavvcceseoissesia.cea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivseavvcseoissesia.oea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivseavvcseoissesia.oea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivseavvecesesesia.cea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200063999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivseavvecesesesia.cea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivseavvesesesia.aea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivseavvesesesia.aea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsevcarvaaecsei.aao.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsevcarvaaecsei.aao.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsevcarvaaecsei.aao.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsevcvraaseci.ao.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsevcvraaseci.ao.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsevcvraaseci.ao.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsevecacrvaaecsei.aaoaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsevecacrvaaecsei.aaoaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsevecacrvaaecsei.aaoaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsevecvcraaseci.aoaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsevecvcraaseci.aoaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsevecvcraaseci.aoaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsiecaiecsn.viscaieaeeivsei.strvlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivssavcacsevi.vievevcrvnvsa.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivssavcacsevi.vievevcrvnvsa.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivssavcacsevi.vievevcrvnvsa.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivssvcasevi.vivevcvnvsa.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivssvcasevi.vivevcvnvsa.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivssvccsrasevi.vivevcvaseronvsa.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivssvccsrasevi.vivevcvaseronvsa.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivssvccsrasevi.vivevcvaseronvsa.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsvacei.vivsvcesias.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsvacei.vivsvcesias.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsvacei.vivsvcesias.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200064033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsvacei.vivsvcesias.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200064034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsvacei.vivsvcesias.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsvacei.vivsvcesias.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsvacei.vivsvcesias.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvacvecnvci.vievcaarsenvs.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvacvecnvci.vievcaarsenvs.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvacvecnvci.vievcaarsenvs.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvacvecnvci.vievcaarsenvs.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvcavaesei.aa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvcavaesei.aa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvcavaesei.aa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvceavcaesei.aaaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvceavcaesei.aaaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvceavcaesei.aaaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvcevacsei.aaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvcevacsei.aaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvcevacsei.aaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvcvasei.a.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvcvasei.a.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvcvasei.a.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvcvcsrenvci.vivcaasaseroenvs.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvcvcsrenvci.vivcaasaseroenvs.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvcvcsrenvci.vivcaasaseroenvs.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvcvenvci.vivcaasenvs.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvcvenvci.vivcaasenvs.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvcvenvci.vivcaasenvs.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvcvenvci.vivcaasenvs.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvecisecsn.viscaseecvsvei.strvlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2f18.219.14.108/index.php?key=ccugr"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2f35.229.41.22?key=n4jki,email=email@icloud.com&post=11231_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2fhumanity06.com%2fwp-content%2fthemes%2fapi.html"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2firsgov-refundprogram.online%2f%3fverify"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://168.61.163.101/index.html?key=oppca,email=irs.government@icloud.com&amp\;post=63156_1&amp\;cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.1.185.241/index.html?key=oppca,email=trackfinance@irs.gov&post=63156_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.109.41.124?key=a0j3o,email=kminella@icloud.com&post=13847_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.109.41.124?key=mk9z6,email=lupekerber@yahoo.com&post=82701_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.110.189.189?key=e86i8,email=email@icloud.com&post=52917_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.110.189.189?key=ujas3,email=email@icloud.com&post=95993_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.110.73.46?key=rpgvc,email=email@icloud.com&post=35214_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.117.201.219?key=a9anr,email=email@icloud.com&post=67925_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.117.201.219?key=a9anr,email=kminella@icloud.com&post=67925_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.121.2.22/index.html?key=oppca,email=trackfinance@irs.gov&post=63156_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.203.161.161?key=bekja,email=kimberlidismuke13@icloud.com&post=98876_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.203.161.161?key=dlqg7,email=email@icloud.com&post=88353_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.203.161.161?key=ffiqb,email=email@icloud.com&post=65185_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.203.161.161?key=tqayb,emai=email@icloud.com&post=01286_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.203.161.161?key=wuhq2,email=mariareyes7826@icloud.com&post=15402_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.213.164.95?key=jdlwh"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.213.46.217?key=bgckvctutk"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.213.49.9/?key=voqj5,email=durincat8@icloud.com&post=19202_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.222.3.107?key=rtudqaeeba"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.222.3.107?key=skfefvlukk"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.222.35.247?key=iguhqpukhn"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.229.141.100/index.html?key=oppca,email=irs.government@icloud.com&amp\;post=63156_1&amp\;cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.230.50.243?key=uyffw,email=email@sbcglobal.net&post=87074_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.239.152.26/index.html?key=oppca,email=irs.government@icloud.com&post=63156_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.39.209.90?key=hcirs,email=email@icloud.com&post=94243_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.40.64.158?key=0uqyr,email=email@yahoo.com&post=94707_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.40.64.158?key=sbjxm,email=email@yahoo.com&post=31496_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.68.105.113?key=gojjs,email=email@icloud.com&post=65211_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.68.105.113?key=hiumv,email=golder.cm@icloud.com&post=58507_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.68.105.113?key=ihwbn,email=email@icloud.com&post=01341_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.68.105.113?key=qba0d,email=email@icloud.com&post=85453_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.70.19.11?key=ejkco,email=dlighted@icloud.com&post=16970_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.70.19.11?key=nn7jd,email=email@icloud.com&post=71936_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.70.19.11?key=pcah4,email=email@icloud.com&post=58184_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.74.246.12?key=1g3zv,email=email@icloud.com&post=71118_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.74.246.12?key=7opkq,email=dylanmarilyn@icloud.com&post=19298_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.74.246.12?key=bs0x8,email=email@icloud.com&post=97474_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.74.246.12?key=dtruh,email=email@icloud.com&post=48614_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.74.246.12?key=m4rhr,email=email@icloud.com&post=09923_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.77.66.21?key=nc14b,email=ebynum84@icloud.com&post=99099_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.91.205.251?key=dlykh,email=samantha.adams76@icloud.com&post=04213_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.91.205.251?key=pj3yz,email=email@icloud.com&post=67421_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://40.117.61.134/index.html?key=oppca,email=trackfinance@irs.gov&post=63156_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://40.77.6.54?key=oppca"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://40.82.145.107?key=nr1yf,email=nccollis@icloud.com&post=15853_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://40.87.142.94?key=mgpnmfsjjt"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://51.12.50.209?key=vkmgm,email=samyafinley@icloud.com&post=27530_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://52.14.205.198?key=qu11c"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://52.179.20.96?key=8s5yy,email=jhnpaul@icloud.com&post=99298_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://52.179.20.96?key=pjway,email=tkey8@icloud.com&post=45230_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fartesvladshiola.com%2f.well-known%2fpki-validation%2fsondu%2fkomuter&post=696668869_33&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fedelwiral.info%2fwp-includes%2fsodium_compat%2fnamespaced%2fcore%2fcurve25519%2fgose&post=696668869_17&cc_key=/?xjxiixmi-suirs70143986"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2femtowersgroup.com%2fwp-admin%2fimages%2fgrak%2fsus&post=696668869_19&cc_key=/?uccxgwww-kampo32395997"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2frdx-federal.com%2f&post=710109641_2"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2ftempt.lk%2fhosr&post=696668869_21&cc_key=/?hbijqrvf-mom71222564"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fwolffun.net%2fwp-includes%2fwidgets%2fxloa%2fclose%2f&post=696668869_14&cc_key=/?xoxlosml-usa34359382"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://amrutimba.com/css/api.php?key={random_letternumberuplow_5},email={email}&post={random_number_5}_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://dashtipour.com/wp-content/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://forextradingtruth.com/wp-includes/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://gociate.com/wp-content/acayganz.html?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://greyhillconsulting.com/assets/css/api.html?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://hayvanatbahcesi.net/wp-admin/includes/api.html?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://jindalbuildcon.com/wp-includes/assets/api.html?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://leviathandesign.com.au/assets/img/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://leviathandesign.com.au/assets/include/apiacy.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://maxvaloan.com/wp-includes/js/api-gantengcuy.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://naturesbuffet.co.in/api-lrsbaru.html?key={random_letternumberuplow_5},email={email}&post={random_number_5}_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://neonamsterdam.com/wp-admin/css/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://pyxcapital.com/wp-content/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://rdx-usaprofilefederal.com?key=nfhjn,email=email@email.com&post=47493_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://rdx-usaprofilefederal.com?key=zza21,email=email@email.com&post=39704_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://senvang.com.au/wp-includes/css/apikeren.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://serv.jembudirenkgk.com/sple/sadjhfjhcuic?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://srv.remaikerea.com/apa/wisedanlah?key=dvnd3,email=apohlmann@icloud.com&post=60667_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://themagone.com/wp-admin/js/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://twitter.com?w5htjopplcko0cun0kky&cc_key=?trackingid=o9xc3cyu&signature=newsletter"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://wpcdecor.com/wp-includes/acy-ling.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.ciudadanoseguro.cl/wp-admin/css/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.ciudadanoseguro.cl/wp-content/themes/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.mathelin-teinture-tissus.com/assets/include/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.newlifenursery.com/assets/rdt.html?key=lwhi1"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.pawcz.cn/wp-includes/css/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.pawcz.cn/wp-includes/js/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.thaitheparos.com/assets/css/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.ulicapolska.pl/public/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://yavuzhanotel.com/wp-content/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsaaiaaececori.vsavcarveoia.hjjpju.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsacaseeeicscori.vsaaevcaarsvcrriai.jwfbzu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vscaoseaaaeeri.vsaccavaeooair.retdou.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vscaoseaaaseri.vsaccavaeorair.hjjpju.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsccaoseeaacaseri.vsaccavsaerorairi.retdou.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsccaseeaicaseri.vsaccaeavsaaercrairi.jbdwnu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsioscaeevi.viccavcoorr.nmmuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvecsoicseavcia.c.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvecsoicseavcia.c.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvecsoisavcia.o.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvecsoisavcia.o.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvecsvoiceseavcia.cea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvecsvoiceseavcia.cea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvecsvoiseavcia.oea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvecsvoiseavcia.oea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsveevcscoeiasvcia.c.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsveevcscoeiasvcia.c.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsveevcsoiasvcia.o.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsveevcsoiasvcia.o.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsveevsacsevcia.c.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsveevsacsevcia.c.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsveevsasvcia.a.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsveevsasvcia.a.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsveevvcsceoeiasvcia.cea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsveevvcsceoeiasvcia.cea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsveevvcsoeiasvcia.oea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsveevvcsoeiasvcia.oea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsveevvsacesevcia.cea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsveevvsacesevcia.cea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsveevvsasevcia.aea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsveevvsasevcia.aea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvevsavcceia.c.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvevsavcceia.c.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvevsavcia.a.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvevsavcia.a.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvevsvavceceia.cea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvevsvavceceia.cea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvevsvavceia.aea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvevsvavceia.aea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200064190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8jdu/sb6/index.php?_&amp\;_"; http_uri; nocase; content:"wallieget.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8jdu/sb6/index.php?_&amp\;_&amp\;_"; http_uri; nocase; content:"wallieget.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/o2/a/f5s4y/0"; http_uri; nocase; content:"warriorplus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/client/index.php"; http_uri; nocase; content:"web.ib.miizuhabanknbest.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/client/index_sp.php"; http_uri; nocase; content:"web.ib.mizuhobankz.japan-servlet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/explorer"; http_uri; nocase; content:"webdeficonnect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/themes/sketch/js/sf_trash/c45b222914e3c78d"; http_uri; nocase; content:"webuyworkshopequipment.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/themes/sketch/js/sf_trash/c45b222914e3c78d/"; http_uri; nocase; content:"webuyworkshopequipment.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/company/banco-original"; http_uri; nocase; content:"weps.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200064199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@bt_home"; http_uri; nocase; content:"withkoji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@bt_internet"; http_uri; nocase; content:"withkoji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@bt_service_alert."; http_uri; nocase; content:"withkoji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@bt_teem"; http_uri; nocase; content:"withkoji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@bt_update"; http_uri; nocase; content:"withkoji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@bt_upgrade"; http_uri; nocase; content:"withkoji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@btinternet"; http_uri; nocase; content:"withkoji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@yahoo2022"; http_uri; nocase; content:"wlo.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200064207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/testing02"; http_uri; nocase; content:"wow.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200064208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/aenzov.html"; http_uri; nocase; content:"xerclinexz.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200064209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rpn.efiler/5/sndn.php"; http_uri; nocase; content:"yes-homeimprovement.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lnk/aviaafdyff0aaaaaaaaaakgsmskaarrcx84aaaaaaaujsqbiopgpjk060qnwsympywp8hbywrwag4vu/1/x-rjpxkcaqm-siod1xer8w/ahr0cdovl2vtywlslmlvbm9zlw9ubgluzs1tyxjrzxrpbmcuznivzs9jl2v5smxiv0zwyky5cfpdstzjbepmum0xqlvvrknaamrvyurnde1gagzwamrczdb0dlprd3rrelvptenkb2ntvm1jam9pyuhsmgnittzmetl0zvm1cgiynxzjetvty2k5amiyntbzv04wswl3awfxntbawep1wvd3au9psmhnvfkyttjkbu5ewmlprfztturaaklpd2lir2x1yte5cfpdstzoakf3t0rbm09uzdkvzwzmyzi5nzjhoti0oduwmtvhntq5nde2ztvmmwixnznhzwm5nznjzjfjmzu4mmmxyzvjowixywixmzlmntqyoq"; http_uri; nocase; content:"ywxo.mjt.lu"; content:"Host"; http_header; classtype:attempted-recon; sid:200064211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/#test@test.com"; http_uri; nocase; content:"zi0034034323.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200064212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/?serviceurl=/qudustemitope455/form/signinyourbtaccountcorrectly/share"; http_uri; nocase; content:"zoho.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200064213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/efrrqedv9fec#michael@.yorku.ca"; http_uri; nocase; content:"zpr.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200064214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gn8bkuunkc6m"; http_uri; nocase; content:"zpr.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200064215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kms8u47zlxwk"; http_uri; nocase; content:"zpr.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200064216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mxvzwlcdizyq"; http_uri; nocase; content:"zpr.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200064217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nckeqquhrpuf"; http_uri; nocase; content:"zpr.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200064218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uyydv5mqujps"; http_uri; nocase; content:"zpr.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200064219; rev:1;)